Edit tour

Windows Analysis Report
LLLLLLLLASSSEERRRR.ps1

Overview

General Information

Sample name:	LLLLLLLLASSSEERRRR.ps1
Analysis ID:	1615024
MD5:	48ad8b6a207ff9dd09d652e96d1126e3
SHA1:	d8f92da428011292f8565e88bbe70410809f6462
SHA256:	c3201db81449ee8d250a922e98847c0465f85bc6dfd95045c731b02925f835d1
Tags:	196-251-92-64ps1user-JAMESWT_MHT
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7352 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

x.exe (PID: 7616 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: E6BB2F3D369794262E51FC97BA9672E9)

RegAsm.exe (PID: 7668 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

y85te3vqfc6QGAKyw78l.exe (PID: 2772 cmdline: "C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\ybvre74SC.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

runonce.exe (PID: 8028 cmdline: "C:\Windows\SysWOW64\runonce.exe" MD5: 9E16655119DDE1B24A741C4FD4AD08FC)

y85te3vqfc6QGAKyw78l.exe (PID: 1604 cmdline: "C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\LN17FRKCEk.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 5464 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

notepad.exe (PID: 7552 cmdline: "C:\Windows\System32\notepad.exe" "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1" MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2613383446.0000000004F30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1835704349.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2613236980.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.2612552379.00000000013C0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1836454389.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2602590342.0000000003250000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1838271008.0000000003020000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2613263682.0000000002620000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: powershell.exe PID: 7352	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x56970:$b1: ::WriteAllBytes( 0x7f6c5:$b1: ::WriteAllBytes( 0x5698c:$b2: ::FromBase64String( 0x7f6e1:$b2: ::FromBase64String( 0x13455:$s1: -join 0x13504:$s1: -join 0x13729:$s1: -join 0x13a27:$s1: -join 0x13a59:$s1: -join 0x13aa1:$s1: -join 0x13ace:$s1: -join 0x13f74:$s1: -join 0x13fd2:$s1: -join 0x14011:$s1: -join 0x14062:$s1: -join 0x14f10:$s1: -join 0x18315:$s1: -join 0x184d3:$s1: -join 0x4f7af:$s1: -join 0x508e9:$s1: -join 0x16bf68:$s1: -join
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
5.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5568, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", ProcessId: 7352, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5568, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1", ProcessId: 7352, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T12:37:22.233047+0100	2855465	1	A Network Trojan was detected	192.168.2.9	59019	162.218.30.235	80	TCP
2025-02-14T12:37:46.281283+0100	2855465	1	A Network Trojan was detected	192.168.2.9	59023	103.106.67.112	80	TCP
2025-02-14T12:37:59.838826+0100	2855465	1	A Network Trojan was detected	192.168.2.9	59027	104.21.48.1	80	TCP
2025-02-14T12:38:13.481500+0100	2855465	1	A Network Trojan was detected	192.168.2.9	59031	104.21.112.1	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T12:37:38.303274+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59020	103.106.67.112	80	TCP
2025-02-14T12:37:40.857309+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59021	103.106.67.112	80	TCP
2025-02-14T12:37:43.403146+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59022	103.106.67.112	80	TCP
2025-02-14T12:37:52.844518+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59024	104.21.48.1	80	TCP
2025-02-14T12:37:54.609147+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59025	104.21.48.1	80	TCP
2025-02-14T12:37:57.281454+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59026	104.21.48.1	80	TCP
2025-02-14T12:38:05.620076+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59028	104.21.112.1	80	TCP
2025-02-14T12:38:08.157473+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59029	104.21.112.1	80	TCP
2025-02-14T12:38:10.771982+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59030	104.21.112.1	80	TCP
2025-02-14T12:38:19.829823+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59032	134.122.135.48	80	TCP
2025-02-14T12:38:22.481853+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59033	134.122.135.48	80	TCP
2025-02-14T12:38:25.219377+0100	2855464	1	A Network Trojan was detected	192.168.2.9	59034	134.122.135.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.tumbetgirislinki.fit/k566/	Avira URL Cloud: Label: malware
Source: http://www.seasay.xyz/c9ts/	Avira URL Cloud: Label: malware
Source: http://www.lucynoel6465.shop/jgkl/	Avira URL Cloud: Label: malware
Source: http://www.kjuw.party/e0jv/	Avira URL Cloud: Label: malware
Source: https://www.seasay.xyz/c9ts/?ddE=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExAyaJn	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

ReversingLabs: Detection: 61%

Multi AV Scanner detection for submitted file

Source: LLLLLLLLASSSEERRRR.ps1

ReversingLabs: Detection: 24%

Yara detected FormBook

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2613383446.0000000004F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1835704349.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2613236980.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2612552379.00000000013C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1836454389.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2602590342.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1838271008.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2613263682.0000000002620000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: runonce.pdbGCTL source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2608539411.000000000085E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegAsm.exe, 00000005.00000002.1836620489.0000000002CD0000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 0000000A.00000003.1838270102.000000000509F000.00000004.00000020.00020000.00000000.sdmp, runonce.exe, 0000000A.00000002.2614142025.0000000005250000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 0000000A.00000002.2614142025.00000000053EE000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 0000000A.00000003.1835974299.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 00000005.00000002.1836620489.0000000002CD0000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, runonce.exe, 0000000A.00000003.1838270102.000000000509F000.00000004.00000020.00020000.00000000.sdmp, runonce.exe, 0000000A.00000002.2614142025.0000000005250000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 0000000A.00000002.2614142025.00000000053EE000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 0000000A.00000003.1835974299.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: runonce.pdb source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2608539411.000000000085E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: VZXCSD.pdb source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp, x.exe, 00000004.00000000.1344241466.00000000003FE000.00000002.00000001.01000000.0000000A.sdmp, x.exe.0.dr
Source:	Binary string: VZXCSD.pdbX source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp, x.exe, 00000004.00000000.1344241466.00000000003FE000.00000002.00000001.01000000.0000000A.sdmp, x.exe.0.dr
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000000.1756318795.000000000012F000.00000002.00000001.01000000.0000000B.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2602571364.000000000012F000.00000002.00000001.01000000.0000000B.sdmp

Source: C:\Windows\SysWOW64\runonce.exe

Code function: 10_2_0326C8D0 FindFirstFileW,FindNextFileW,FindClose,

10_2_0326C8D0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\SysWOW64\runonce.exe	Code function: 4x nop then xor eax, eax		10_2_03259EF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 4x nop then mov ebx, 00000004h		10_2_050304E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:59027 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59022 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59020 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:59019 -> 162.218.30.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59025 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59029 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59021 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:59031 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59024 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59032 -> 134.122.135.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:59023 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59030 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59028 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59034 -> 134.122.135.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59033 -> 134.122.135.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:59026 -> 104.21.48.1:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.l63339.xyz
Source:	DNS query: www.seasay.xyz

Source: global traffic

TCP traffic: 192.168.2.9:58925 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 103.106.67.112 103.106.67.112
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /vhr7/?uxPH=qD4HNfCp70&ddE=iaSfD1StI7hDT4qIAMii2AJAHOe0qHDn7gYmLjmbAGxKTACTDmsoqhtbBCAt1Ym3ncJClzXtgr7Snspij9c4o2GNlbdMtrDimVv8q0bADTP2MW58ag== HTTP/1.1Host: www.l63339.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /c9ts/?ddE=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExAyaJnRUVMUOnSQnGJ4mxt7UxshhdjBGkpYiovfB8EVbaaI8Ibdvw==&uxPH=qD4HNfCp70 HTTP/1.1Host: www.seasay.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /k566/?uxPH=qD4HNfCp70&ddE=RARW43WNMKajmHoYlEtIRJLMiezSzeuXvXreCHJ6fEp5jkldk9mcWmm/U2k918FOdcoJ/x5nnQwLxIae2MHe6OYJ2CZYvza1X4jE5qPwznFDfci4lg== HTTP/1.1Host: www.tumbetgirislinki.fitAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /jgkl/?ddE=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpe8No0hPfAwO5oFY7qBV6wzFyOtp6qA==&uxPH=qD4HNfCp70 HTTP/1.1Host: www.lucynoel6465.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5

Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.l63339.xyz
Source: global traffic	DNS traffic detected: DNS query: www.seasay.xyz
Source: global traffic	DNS traffic detected: DNS query: www.tumbetgirislinki.fit
Source: global traffic	DNS traffic detected: DNS query: www.lucynoel6465.shop
Source: global traffic	DNS traffic detected: DNS query: www.kjuw.party

Source: unknown

HTTP traffic detected: POST /c9ts/ HTTP/1.1Host: www.seasay.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateOrigin: http://www.seasay.xyzReferer: http://www.seasay.xyz/c9ts/Content-Length: 192Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5Data Raw: 64 64 45 3d 57 30 4a 59 34 44 6c 67 38 7a 6d 57 35 46 36 57 58 32 78 58 4d 50 49 78 69 4a 75 36 49 52 48 59 6e 55 4c 6b 7a 41 74 66 75 65 4b 75 72 51 35 70 50 52 74 73 32 58 79 46 63 6c 75 6f 49 52 59 54 59 4b 44 4b 54 43 74 31 59 32 2f 49 30 47 63 49 70 45 34 70 57 54 45 55 36 4b 7a 67 50 58 5a 69 6f 64 6d 78 4c 71 6f 66 58 49 2b 4c 37 36 62 4b 35 66 52 48 31 69 32 65 45 32 57 75 44 59 42 30 36 32 51 56 2f 32 4d 73 62 32 48 6b 75 32 32 5a 47 36 32 51 35 4f 2b 50 30 55 43 61 74 4b 43 4f 30 4e 36 54 63 47 31 6d 74 42 6d 38 77 75 39 44 2b 79 52 2b 56 7a 4e 70 66 38 65 37 Data Ascii: ddE=W0JY4Dlg8zmW5F6WX2xXMPIxiJu6IRHYnULkzAtfueKurQ5pPRts2XyFcluoIRYTYKDKTCt1Y2/I0GcIpE4pWTEU6KzgPXZiodmxLqofXI+L76bK5fRH1i2eE2WuDYB062QV/2Msb2Hku22ZG62Q5O+P0UCatKCO0N6TcG1mtBm8wu9D+yR+VzNpf8e7

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:37:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LW0oLJBvAKwPhNb%2FPpFAXdgW8Fw84NTfg%2B%2F3qfAo29W2xtn3zLKXB3uM7VdZrEUgjXYNT28%2Fl6D3tIWgf2%2BWG4Ch32O3FfnSB%2FvjxKEC5Ch3tAQ3sHXuRncAGG15sT9LrtrLX52Mk2ya7wc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc4d23a2a7c94-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1782&min_rtt=1782&rtt_var=891&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=839&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 30 32 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a 59 93 a3 48 92 7e ef 5f a1 ad b5 35 9b 31 2a 87 fb ca ae 6a 5b 6e 90 04 02 04 08 f4 c6 0d e2 14 b7 34 36 ff 7d 4d 99 d5 d5 59 59 52 75 f5 ce 3e 6c bc 88 20 dc 3d c2 af cf 43 11 fc f2 cb 2f 9f fe 83 df 71 96 a7 0b ab 6c a8 ca df 7e f9 f4 fa b3 5a ad 56 9f b2 d8 8f be 3c 56 f1 e0 af b2 61 68 9f e2 f3 98 4f 9f 3f 70 4d 3d c4 f5 f0 34 5c da f8 c3 2a 7c ed 7d fe 30 c4 cb 00 de 44 fc ba 0a 33 bf eb e3 e1 f3 38 24 4f d4 87 87 72 fc 30 8b 9f 6e fc 5d 53 be 11 54 37 4f e1 6d e8 21 a3 de f9 69 e5 ff 15 0e 61 69 f3 2e ee df b0 40 df d0 d6 7e 15 7f fe 30 e5 f1 dc 36 dd f0 86 6c ce a3 21 fb 1c c5 53 1e c6 4f 2f 9d 8f ab bc ce 87 dc 2f 9f fa d0 2f e3 cf f0 3f be 8a 1a f2 a1 8c 7f c3 20 6c a5 35 c3 4a 6c c6 3a fa 04 be be 7c 25 e8 87 4b 19 af 6e 76 fb 62 ae b0 ef bf 30 df 5a d0 44 97 d5 3f bf 76 6f 2d 69 ea e1 29 f1 ab bc bc 3c af 98 2e f7 cb 8f 2b 39 2e a7 78 c8 43 ff e3 aa f7 eb fe a9 8f bb 3c f9 f5 7b b6 3e bf c6 cf 2b 18 6b 97 6f 07 cb bc 8e 9f b2 38 4f b3 e1 79 05 ff 03 43 Data Ascii: 102dZYH~_51j[n46}MYYRu>l =C/ql~ZV<VahO?pM=4\\|}0D38$Or0n]ST7Om!iai.@~06l!SO///? l5Jl:\|%Knvb0ZD?vo-i)<.+9.xC<{>+ko8OyC
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:37:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X6bW4OnaLd%2FWD21cnxWtYZeArMKWBgBrg6oianpWAv38cclKZXlXppwIlQD7TEJbVIgdKf%2FGN4agKcPjDIqUIK%2FM2qrFyJ%2FWNeloUcOIwqnywwnblH8ieG8H6522HcdXMCXX9%2Be68fcGVpY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc4e2dccf1a24-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1887&min_rtt=1887&rtt_var=943&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1852&delivery_rate=0&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a 31 32 66 62 0d 0a cc 5a 59 97 a3 4a 72 7e bf bf 42 ae 39 b6 67 0e 5d cd be d5 ad 6a 1b 10 12 48 02 01 12 92 d0 cb 3d 09 24 8b 58 c5 2e f9 cc 0f f2 df f0 2f f3 51 55 2f d5 55 52 77 df 19 3f 38 1f 4a 64 66 44 64 64 2c 5f 50 99 fc f6 db 6f 8f ff 32 5e 4a 6b c7 90 47 51 93 a5 9f 7e 7b 7c f9 19 8d 46 a3 c7 08 02 ff f3 63 06 1b 30 8a 9a a6 bc 87 c7 36 ee 9e ee a4 22 6f 60 de dc 37 a7 12 de 8d bc 97 de d3 5d 03 87 06 bd 88 f8 7d e4 45 a0 aa 61 f3 d4 36 c1 3d 77 77 53 0e f0 22 78 7f e1 af 8a f4 95 a0 bc b8 f7 2e 53 37 19 8d 0a 84 19 f8 33 1c f2 50 c6 15 ac 5f b1 60 df d1 e6 20 83 4f 77 5d 0c fb b2 a8 9a 57 64 7d ec 37 d1 93 0f bb d8 83 f7 cf 9d 0f a3 38 8f 9b 18 a4 f7 b5 07 52 f8 84 7f fc 2a aa 89 9b 14 7e a2 30 6a a4 17 cd 68 52 b4 b9 ff 88 be 0c be 10 d4 cd 29 85 a3 8b dd 3e 9b cb ab eb cf cc 97 e6 16 fe 69 f4 5f 5f bb 97 16 14 79 73 1f 80 2c 4e 4f 0f 23 a1 8a 41 fa 61 a4 c0 b4 83 4d ec 81 0f a3 1a e4 f5 7d 0d ab 38 f8 fd 3d 5b 1d 9f e1 c3 08 a7 ca e1 fb c9 34 ce e1 Data Ascii: f12fbZYJr~B9g]jH=$X./QU/URw?8JdfDdd,_Po2^JkGQ~{\|Fc06"o`7]}Ea6=wwS"x.S73P_` Ow]Wd}78R*~0jhR)>i__ys,NO#AaM}8=[4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:37:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWBWsn0Q6zMydut34po5PrvAKK%2Bnp1znmoVmIF7IBmqwjKSnGPvr5UeqqTdf6ImbEavn8nFx28%2BSMZtee5cNrSWQeonXdDpl%2B6OqohYbaFpJJSSWEvBOENuU7xhJ6tRruFcT%2F2bc38Dni8k%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc4f2dffc0f99-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1482&rtt_var=741&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=543&delivery_rate=0&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 61 31 65 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c Data Ascii: 2a1e<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <titl
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:38:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGanyTt1TsrOogO42lKwedoGqEYu6vKmlULfrhFTZDIb%2Bv60g4F7AgGc2tl1a5kfX9TPGE%2BZagTLqPvfugC%2FlzvXvItioonZ4ThyD5wznCyIXUm7VSTIBDDXsL%2BWkH5lFW%2Fk6vAfTSg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc5172f598c0b-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1998&min_rtt=1998&rtt_var=999&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=806&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:38:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1hL%2BpES0eMF8zXgAVom81N%2FNymkDQnRBjst2HfN66xlhL%2BJA0tXd1fgDcXSPsef4n%2BzQIt%2BU%2B%2Fen%2FGZg6djpCDTxGlZCEfNquXPM8r2qzeb8DSFdnxg0S1NgVcnWOkTY0AEPi5WmIjo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc526f8a53314-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1972&min_rtt=1972&rtt_var=986&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=830&delivery_rate=0&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:38:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XkWqvjwFKdNhtcBS%2FRHsXvcDR4Mpn8nDTslcF4moJhKyNTJ6U7GMlmWTw840kpGkIpk0k9Lk9MFXKHtst0Ea666riE4QIwyP5Hhse3gHGmXU%2Fi11STU0hISa2bXSt9S0ZWZXWx1EtPs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc5375a4a4316-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1582&rtt_var=791&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1843&delivery_rate=0&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Feb 2025 11:38:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hTL4T9jSjk5beu4UV49ai%2BCwdLKQlwvuoDLRTV9SEtAFEvijBy%2FK%2Fr2b%2Bkp%2F%2BhHnjlBskDonDRny7QSaBcD08KLLZ0DtUr19ZqkL0E8YKJiB%2BujgUovzUs0hOTjSu%2BfpW2muj3HHTRE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 911cc5481c390c88-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1621&rtt_var=810&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=540&delivery_rate=0&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 148Content-Type: text/htmlDate: Fri, 14 Feb 2025 11:38:19 GMTEtag: "6746afef-94"Server: nginxX-Cache: BYPASSConnection: closeData Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 148Content-Type: text/htmlDate: Fri, 14 Feb 2025 11:38:22 GMTEtag: "6746afef-94"Server: nginxX-Cache: BYPASSConnection: closeData Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 148Content-Type: text/htmlDate: Fri, 14 Feb 2025 11:38:25 GMTEtag: "6746afef-94"Server: nginxX-Cache: BYPASSConnection: closeData Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: runonce.exe, 0000000A.00000002.2615702549.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2613908112.0000000003968000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1348711002.0000000005426000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1348711002.00000000052D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1348711002.0000000005426000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2612552379.0000000001415000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kjuw.party
Source: y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2612552379.0000000001415000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kjuw.party/e0jv/
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000000.00000002.1348711002.00000000052D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000000.00000002.1348711002.0000000005426000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: runonce.exe, 0000000A.00000002.2608327762.000000000368C000.00000004.00000020.00020000.00000000.sdmp, runonce.exe, 0000000A.00000002.2608327762.0000000003669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: runonce.exe, 0000000A.00000002.2608327762.000000000368C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: runonce.exe, 0000000A.00000003.2018673679.00000000081F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: runonce.exe, 0000000A.00000002.2608327762.0000000003669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: runonce.exe, 0000000A.00000002.2608327762.0000000003669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: runonce.exe, 0000000A.00000002.2608327762.0000000003669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: runonce.exe, 0000000A.00000002.2608327762.0000000003669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powershell.exe, 00000000.00000002.1362764872.000000000633A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: runonce.exe, 0000000A.00000002.2617122118.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2613908112.00000000037D6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.seasay.xyz/c9ts/?ddE=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExAyaJn
Source: runonce.exe, 0000000A.00000002.2615702549.0000000005C64000.00000004.10000000.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2613908112.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2126788211.000000002B9E4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://wx.longwaysun.com/app/register.php?site_id=2239&topId=86884/vhr7/
Source: runonce.exe, 0000000A.00000002.2615702549.0000000005C64000.00000004.10000000.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2613908112.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2126788211.000000002B9E4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://wx.longwaysun.com/app/register.php?site_id=2239&topId=86884/vhr7/

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2613383446.0000000004F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1835704349.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2613236980.0000000004EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2612552379.00000000013C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1836454389.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2602590342.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1838271008.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2613263682.0000000002620000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7352, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

PE file contains section with special chars

Source: x.exe.0.dr

Static PE information: section name: |]e@TkD

PE file has nameless sections

Source: x.exe.0.dr

Static PE information: section name:

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042CAA3 NtClose,	5_2_0042CAA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42B60 NtClose,LdrInitializeThunk,	5_2_02D42B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_02D42C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_02D42DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D435C0 NtCreateMutant,LdrInitializeThunk,	5_2_02D435C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D44340 NtSetContextThread,	5_2_02D44340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D44650 NtSuspendThread,	5_2_02D44650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42AD0 NtReadFile,	5_2_02D42AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42AF0 NtWriteFile,	5_2_02D42AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42AB0 NtWaitForSingleObject,	5_2_02D42AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42BF0 NtAllocateVirtualMemory,	5_2_02D42BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42BE0 NtQueryValueKey,	5_2_02D42BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42B80 NtQueryInformationFile,	5_2_02D42B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42BA0 NtEnumerateValueKey,	5_2_02D42BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42EE0 NtQueueApcThread,	5_2_02D42EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42E80 NtReadVirtualMemory,	5_2_02D42E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42EA0 NtAdjustPrivilegesToken,	5_2_02D42EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42E30 NtWriteVirtualMemory,	5_2_02D42E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42FE0 NtCreateFile,	5_2_02D42FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42F90 NtProtectVirtualMemory,	5_2_02D42F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42FB0 NtResumeThread,	5_2_02D42FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42FA0 NtQuerySection,	5_2_02D42FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42F60 NtCreateProcessEx,	5_2_02D42F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42F30 NtCreateSection,	5_2_02D42F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42CC0 NtQueryVirtualMemory,	5_2_02D42CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42CF0 NtOpenProcess,	5_2_02D42CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42CA0 NtQueryInformationToken,	5_2_02D42CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42C60 NtCreateKey,	5_2_02D42C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42C00 NtQueryInformationProcess,	5_2_02D42C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42DD0 NtDelayExecution,	5_2_02D42DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42DB0 NtEnumerateKey,	5_2_02D42DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42D10 NtMapViewOfSection,	5_2_02D42D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42D00 NtSetInformationFile,	5_2_02D42D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D42D30 NtUnmapViewOfSection,	5_2_02D42D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D43090 NtSetValueKey,	5_2_02D43090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D43010 NtOpenDirectoryObject,	5_2_02D43010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D439B0 NtGetContextThread,	5_2_02D439B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D43D70 NtOpenThread,	5_2_02D43D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D43D10 NtOpenProcessToken,	5_2_02D43D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C4650 NtSuspendThread,LdrInitializeThunk,	10_2_052C4650
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C4340 NtSetContextThread,LdrInitializeThunk,	10_2_052C4340
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	10_2_052C2D30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2D10 NtMapViewOfSection,LdrInitializeThunk,	10_2_052C2D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_052C2DF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2DD0 NtDelayExecution,LdrInitializeThunk,	10_2_052C2DD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2C60 NtCreateKey,LdrInitializeThunk,	10_2_052C2C60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_052C2C70
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2CA0 NtQueryInformationToken,LdrInitializeThunk,	10_2_052C2CA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2F30 NtCreateSection,LdrInitializeThunk,	10_2_052C2F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2FB0 NtResumeThread,LdrInitializeThunk,	10_2_052C2FB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2FE0 NtCreateFile,LdrInitializeThunk,	10_2_052C2FE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2E80 NtReadVirtualMemory,LdrInitializeThunk,	10_2_052C2E80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2EE0 NtQueueApcThread,LdrInitializeThunk,	10_2_052C2EE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2B60 NtClose,LdrInitializeThunk,	10_2_052C2B60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2BA0 NtEnumerateValueKey,LdrInitializeThunk,	10_2_052C2BA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2BE0 NtQueryValueKey,LdrInitializeThunk,	10_2_052C2BE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_052C2BF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2AF0 NtWriteFile,LdrInitializeThunk,	10_2_052C2AF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2AD0 NtReadFile,LdrInitializeThunk,	10_2_052C2AD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C35C0 NtCreateMutant,LdrInitializeThunk,	10_2_052C35C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C39B0 NtGetContextThread,LdrInitializeThunk,	10_2_052C39B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2D00 NtSetInformationFile,	10_2_052C2D00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2DB0 NtEnumerateKey,	10_2_052C2DB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2C00 NtQueryInformationProcess,	10_2_052C2C00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2CF0 NtOpenProcess,	10_2_052C2CF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2CC0 NtQueryVirtualMemory,	10_2_052C2CC0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2F60 NtCreateProcessEx,	10_2_052C2F60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2FA0 NtQuerySection,	10_2_052C2FA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2F90 NtProtectVirtualMemory,	10_2_052C2F90
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2E30 NtWriteVirtualMemory,	10_2_052C2E30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2EA0 NtAdjustPrivilegesToken,	10_2_052C2EA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2B80 NtQueryInformationFile,	10_2_052C2B80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C2AB0 NtWaitForSingleObject,	10_2_052C2AB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C3010 NtOpenDirectoryObject,	10_2_052C3010
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C3090 NtSetValueKey,	10_2_052C3090
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C3D10 NtOpenProcessToken,	10_2_052C3D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C3D70 NtOpenThread,	10_2_052C3D70
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03279780 NtDeleteFile,	10_2_03279780
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03279680 NtReadFile,	10_2_03279680
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03279510 NtCreateFile,	10_2_03279510
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03279980 NtAllocateVirtualMemory,	10_2_03279980
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03279820 NtClose,	10_2_03279820
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0503F2CF NtReadVirtualMemory,	10_2_0503F2CF
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0503F8C4 NtMapViewOfSection,	10_2_0503F8C4

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00D928D0	4_2_00D928D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00D90848	4_2_00D90848
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00D911E0	4_2_00D911E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00D928C1	4_2_00D928C1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00D907E0	4_2_00D907E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004188F3	5_2_004188F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00403000	5_2_00403000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004100CA	5_2_004100CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042F0D3	5_2_0042F0D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004100D3	5_2_004100D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00401240	5_2_00401240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E2E3	5_2_0040E2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004102F3	5_2_004102F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00416AFE	5_2_00416AFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00416B03	5_2_00416B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402462	5_2_00402462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402470	5_2_00402470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E47C	5_2_0040E47C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E427	5_2_0040E427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E433	5_2_0040E433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402750	5_2_00402750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D902C0	5_2_02D902C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB0274	5_2_02DB0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D1E3F0	5_2_02D1E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DD03E6	5_2_02DD03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCA352	5_2_02DCA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DA2000	5_2_02DA2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC81CC	5_2_02DC81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DD01AA	5_2_02DD01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC41A2	5_2_02DC41A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D98158	5_2_02D98158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DAA118	5_2_02DAA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D00100	5_2_02D00100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D2C6E0	5_2_02D2C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D0C7C0	5_2_02D0C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D34750	5_2_02D34750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D10770	5_2_02D10770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DBE4F6	5_2_02DBE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC2446	5_2_02DC2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB4420	5_2_02DB4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DD0591	5_2_02DD0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D10535	5_2_02D10535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D0EA80	5_2_02D0EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC6BD7	5_2_02DC6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCAB40	5_2_02DCAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D3E8F0	5_2_02D3E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CF68B8	5_2_02CF68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D1A840	5_2_02D1A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D12840	5_2_02D12840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D129A0	5_2_02D129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DDA9A6	5_2_02DDA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D26962	5_2_02D26962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCEEDB	5_2_02DCEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D22E90	5_2_02D22E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCCE93	5_2_02DCCE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D10E59	5_2_02D10E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCEE26	5_2_02DCEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D02FC8	5_2_02D02FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D1CFE0	5_2_02D1CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D8EFA0	5_2_02D8EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D84F40	5_2_02D84F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D30F30	5_2_02D30F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB2F30	5_2_02DB2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D52F28	5_2_02D52F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D00CF2	5_2_02D00CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB0CB5	5_2_02DB0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D10C00	5_2_02D10C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D0ADE0	5_2_02D0ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D28DBF	5_2_02D28DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DACD1F	5_2_02DACD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D1AD00	5_2_02D1AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D2B2C0	5_2_02D2B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB12ED	5_2_02DB12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D152A0	5_2_02D152A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D5739A	5_2_02D5739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CFD34C	5_2_02CFD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC132D	5_2_02DC132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D170C0	5_2_02D170C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DBF0CC	5_2_02DBF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC70E9	5_2_02DC70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCF0E0	5_2_02DCF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D1B1B0	5_2_02D1B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DDB16B	5_2_02DDB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D4516C	5_2_02D4516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CFF172	5_2_02CFF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC16CC	5_2_02DC16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D55630	5_2_02D55630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCF7B0	5_2_02DCF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D01460	5_2_02D01460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCF43F	5_2_02DCF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DD95C3	5_2_02DD95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DAD5B0	5_2_02DAD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC7571	5_2_02DC7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DBDAC6	5_2_02DBDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D55AA0	5_2_02D55AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DADAAC	5_2_02DADAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DB1AA3	5_2_02DB1AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCFA49	5_2_02DCFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC7A46	5_2_02DC7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D83A6C	5_2_02D83A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D85BF0	5_2_02D85BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D4DBF9	5_2_02D4DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D2FB80	5_2_02D2FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCFB76	5_2_02DCFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D138E0	5_2_02D138E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D7D800	5_2_02D7D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D19950	5_2_02D19950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D2B950	5_2_02D2B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DA5910	5_2_02DA5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D19EB0	5_2_02D19EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D11F92	5_2_02D11F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCFFB1	5_2_02DCFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCFF09	5_2_02DCFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DCFCF2	5_2_02DCFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D89C32	5_2_02D89C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D2FDC0	5_2_02D2FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC1D5A	5_2_02DC1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D13D40	5_2_02D13D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02DC7D73	5_2_02DC7D73
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05290535	10_2_05290535
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05350591	10_2_05350591
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05334420	10_2_05334420
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05342446	10_2_05342446
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0533E4F6	10_2_0533E4F6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05290770	10_2_05290770
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052B4750	10_2_052B4750
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0528C7C0	10_2_0528C7C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052AC6E0	10_2_052AC6E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05280100	10_2_05280100
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0532A118	10_2_0532A118
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05318158	10_2_05318158
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053441A2	10_2_053441A2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053501AA	10_2_053501AA
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053481CC	10_2_053481CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05322000	10_2_05322000
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534A352	10_2_0534A352
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053503E6	10_2_053503E6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0529E3F0	10_2_0529E3F0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05330274	10_2_05330274
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053102C0	10_2_053102C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0529AD00	10_2_0529AD00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0532CD1F	10_2_0532CD1F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052A8DBF	10_2_052A8DBF
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0528ADE0	10_2_0528ADE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05290C00	10_2_05290C00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05330CB5	10_2_05330CB5
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05280CF2	10_2_05280CF2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05332F30	10_2_05332F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052D2F28	10_2_052D2F28
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052B0F30	10_2_052B0F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05304F40	10_2_05304F40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0530EFA0	10_2_0530EFA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0529CFE0	10_2_0529CFE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05282FC8	10_2_05282FC8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534EE26	10_2_0534EE26
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05290E59	10_2_05290E59
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534CE93	10_2_0534CE93
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052A2E90	10_2_052A2E90
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534EEDB	10_2_0534EEDB
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052A6962	10_2_052A6962
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052929A0	10_2_052929A0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0535A9A6	10_2_0535A9A6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0529A840	10_2_0529A840
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05292840	10_2_05292840
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052768B8	10_2_052768B8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052BE8F0	10_2_052BE8F0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534AB40	10_2_0534AB40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05346BD7	10_2_05346BD7
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0528EA80	10_2_0528EA80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05347571	10_2_05347571
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0532D5B0	10_2_0532D5B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053595C3	10_2_053595C3
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534F43F	10_2_0534F43F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05281460	10_2_05281460
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534F7B0	10_2_0534F7B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052D5630	10_2_052D5630
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053416CC	10_2_053416CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052C516C	10_2_052C516C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0527F172	10_2_0527F172
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0535B16B	10_2_0535B16B
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0529B1B0	10_2_0529B1B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534F0E0	10_2_0534F0E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053470E9	10_2_053470E9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052970C0	10_2_052970C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0533F0CC	10_2_0533F0CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534132D	10_2_0534132D
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0527D34C	10_2_0527D34C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052D739A	10_2_052D739A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052952A0	10_2_052952A0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_053312ED	10_2_053312ED
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052AB2C0	10_2_052AB2C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05347D73	10_2_05347D73
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05293D40	10_2_05293D40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05341D5A	10_2_05341D5A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052AFDC0	10_2_052AFDC0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05309C32	10_2_05309C32
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534FCF2	10_2_0534FCF2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534FF09	10_2_0534FF09
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534FFB1	10_2_0534FFB1
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05291F92	10_2_05291F92
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05253FD5	10_2_05253FD5
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05253FD2	10_2_05253FD2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05299EB0	10_2_05299EB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05325910	10_2_05325910
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05299950	10_2_05299950
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052AB950	10_2_052AB950
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052FD800	10_2_052FD800
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052938E0	10_2_052938E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534FB76	10_2_0534FB76
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052AFB80	10_2_052AFB80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05305BF0	10_2_05305BF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052CDBF9	10_2_052CDBF9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05303A6C	10_2_05303A6C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05347A46	10_2_05347A46
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0534FA49	10_2_0534FA49
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052D5AA0	10_2_052D5AA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05331AA3	10_2_05331AA3
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0532DAAC	10_2_0532DAAC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0533DAC6	10_2_0533DAC6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03261FD0	10_2_03261FD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325CE47	10_2_0325CE47
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325CE50	10_2_0325CE50
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325B1A4	10_2_0325B1A4
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325B1B0	10_2_0325B1B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325B1F9	10_2_0325B1F9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325B060	10_2_0325B060
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325D070	10_2_0325D070
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03265670	10_2_03265670
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0326387B	10_2_0326387B
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03263880	10_2_03263880
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0327BE50	10_2_0327BE50
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0503E467	10_2_0503E467
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0503E7FC	10_2_0503E7FC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0503D8C8	10_2_0503D8C8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\x.exe 7D7EA0439478D6FE199D07F2FBF892ACD472BA769AA1432A87008D5EF790496F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02D57E54 appears 110 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02D45130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02CFB970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02D7EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02D8F290 appears 105 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 0527B970 appears 280 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 0530F290 appears 105 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 052FEA12 appears 86 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 052D7E54 appears 110 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 052C5130 appears 58 times

Source: Process Memory Space: powershell.exe PID: 7352, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: x.exe.0.dr

Static PE information: Section: |]e@TkD ZLIB complexity 1.0003320970117846

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winPS1@11/8@6/5

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" "C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Process created: C:\Windows\SysWOW64\runonce.exe "C:\Windows\SysWOW64\runonce.exe"
Source: C:\Windows\SysWOW64\runonce.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Process created: C:\Windows\SysWOW64\runonce.exe "C:\Windows\SysWOW64\runonce.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041F04F push ebx; ret	5_2_0041F058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00403280 push eax; ret	5_2_00403282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041AB61 pushfd ; ret	5_2_0041AB78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041ABD6 push ds; ret	5_2_0041ABD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040D38A push edx; iretd	5_2_0040D453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00426CC3 pushad ; iretd	5_2_00426CEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004084DA push esi; retf	5_2_004084DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004084FF push ebp; iretd	5_2_00408502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00412559 push ecx; iretd	5_2_0041255A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004125DC pushfd ; iretd	5_2_004125FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405E25 push ecx; ret	5_2_00405E2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00401F0E push ss; retf	5_2_00401F14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CD225F pushad ; ret	5_2_02CD27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CD27FA pushad ; ret	5_2_02CD27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CD283D push eax; iretd	5_2_02CD2858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02D009AD push ecx; mov dword ptr [esp], ecx	5_2_02D009B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02CD1368 push eax; iretd	5_2_02CD1369
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052527FA pushad ; ret	10_2_052527F9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0525225F pushad ; ret	10_2_052527F9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_052809AD push ecx; mov dword ptr [esp], ecx	10_2_052809B6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0525283D push eax; iretd	10_2_05252858
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_05251368 push eax; iretd	10_2_05251369
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03252BA2 push ecx; ret	10_2_03252BA8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325F359 pushfd ; iretd	10_2_0325F378
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325527C push ebp; iretd	10_2_0325527F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03255257 push esi; retf	10_2_0325525A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_0325F2D6 push ecx; iretd	10_2_0325F2D7
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03267B60 push FFFFFFC3h; ret	10_2_03267BCA
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03273A40 pushad ; iretd	10_2_03273A68
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_03267953 push ds; ret	10_2_03267955
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 10_2_032678DE pushfd ; ret	10_2_032678F5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 4DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 5DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 5F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 6F10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3874			Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Window / User API: threadDelayed 9806			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\runonce.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 7636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8100	Thread sleep count: 166 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8100	Thread sleep time: -332000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8100	Thread sleep count: 9806 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8100	Thread sleep time: -19612000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe TID: 3648	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\runonce.exe	Last function: Thread delayed

Source: 6511-iOQ--.10.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 6511-iOQ--.10.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: runonce.exe, 0000000A.00000002.2608327762.000000000365A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla(I
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 6511-iOQ--.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 6511-iOQ--.10.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 6511-iOQ--.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: firefox.exe, 0000000E.00000002.2128057788.00000171EB59D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 6511-iOQ--.10.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 6511-iOQ--.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 6511-iOQ--.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 6511-iOQ--.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 6511-iOQ--.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 6511-iOQ--.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 6511-iOQ--.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: y85te3vqfc6QGAKyw78l.exe, 0000000D.00000002.2612191080.0000000001219000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: 6511-iOQ--.10.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 6511-iOQ--.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 6511-iOQ--.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 6511-iOQ--.10.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 6511-iOQ--.10.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 6511-iOQ--.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 6511-iOQ--.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 6511-iOQ--.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\SysWOW64\runonce.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files (x86)\UfdujJffCftgkWIRTClUOplhWXIVwQwqHslmKQeprsvFwt\y85te3vqfc6QGAKyw78l.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D63008	Jump to behavior

Source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000000.1757147183.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2610350344.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000000.1909963326.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000000.1757147183.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2610350344.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000000.1909963326.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000000.1757147183.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2610350344.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000000.1909963326.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: y85te3vqfc6QGAKyw78l.exe, 00000009.00000000.1757147183.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 00000009.00000002.2610350344.0000000000F31000.00000002.00000001.00040000.00000000.sdmp, y85te3vqfc6QGAKyw78l.exe, 0000000D.00000000.1909963326.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\Desktop\LLLLLLLLASSSEERRRR.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LLLLLLLLASSSEERRRR.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
LLLLLLLLASSSEERRRR.ps1

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	612 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	612 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement