0b654057aac66c49e8eb909a106df4415a61d8c03cc85e28d261205ff2e212ca.exe
Shadow HVNC loader detected
Unsigned cmd.exe reference creates a Unicode processDetects Shadow HVNC Loader
SHA-2560b654057aac66c49e8eb909a106df4415a61d8c03cc85e28d261205ff2e212ca
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400565755534889c84c8d04114885d20f84VWUSH..L...H....
0x4103e0100004c8d153d095e0031d24989c1>...L..=.^.1.I..
0x420eb27450fb6db470fb61c1341d0eb41f6.'E...G....A..A.
0x430c3010f84210100000f1f840000000000....!...........
0x4404d39c10f84000100004c89ce4889d145M9.......L..H..E
0x4500fb609450fb6d94584db78144c8d4e01...E...E..x.L.N.
0x460eb6e66666666662e0f1f840000000000.nfffff.........
0x4704489da83e21f0fb67e0183e73f4180fbD.......~...?A..
0x480df7634440fb65e02c1e7064183e33f41.v4D..^....A..?A
0x49009fb4180f9f0722d4c8d4e040fb67e03..A...r-L.N...~.
0x4a083e207c1e21241c1e30683e73f4409df......A.....?D..
0x4b009d74189fbeb194c8d4e02c1e20609fa..A....L.N......
0x4c04189d3eb0b4c8d4e03c1e20c4109d390A....L.N....A...
0x4d04c89ca4829f24801ca418d73f783fe05L..H).H..A.s....
0x4e00f825affffff4183fb200f8450ffffff..Z...A.. ..P...
0x4f04181fb8500000072604489dec1ee0883A......r`D......
0x500fe1f7f1985f6743383fe16754c4181fb......t3...uLA..
0x51080160000410f94c3e911ffffff83fe20....A..........
0x5200f84fcfeffff83fe30752e4181fb0030........0u.A...0
0x5300000410f94c3e9f3feffff450fb6db47..A........E...G
0x5400fb61c13e9e5feffff31c931d2e91c01.........1.1....
0x550000031d24989c131c94d39c10f840c01..1.I..1.M9.....
0x5700fb61c16d0ebf6c3010f84e900000090................
0x5804d39c10f84e50000004d89c3410fbe70M9.......M..A..p
0x590ff85f6781b4d8d43ff8d7ef783ff0572...x.M.C..~....r
0x5a0dfeb69666666662e0f1f840000000000..iffff.........
0x5b0410fb67bfe4080ffc07d20410fb65bfdA..{.@...} A..[.
0x5c080fbc07d1f4d8d43fc410fb66bfc83e5...}.M.C.A..k...
0x5d007c1e50683e33f09ebeb104d8d43fe83......?....M.C..
0x5e0e71feb0f4d8d43fd83e30fc1e30683e7....M.C.........
0x5f03f09dfc1e7064080e63f400fb6f609fe?.....@..?@.....
0x6008d7ef783ff050f8274ffffff83fe200f.~......t..... .
0x610846bffffff81fe85000000724b89f7c1.k.........rK...
0x620ef0883ff1f7f1785ff742f83ff167538.........t/...u8
0x63081fe801600000f94c3e938ffffff83ff..........8.....
0x640200f8424ffffff83ff30751c81fe0030 ..$.....0u....0
0x660b61c16e90effffff4c29ca4c01da4829........L).L..H)
0x670ca4801c85b5d5f5ec3cccccccccccccc.H..[]_^........
0x680565755534889c84801d14531c9eb1790VWUSH..H..E1....
0x69049ffc14929c94901d14d89ca4183fb22I..I).I..M..A.."
0x6a00f85940000004939d10f84820000004d......I9.......M
0x6b089c84901c1410fb619440f ..I..A...D.
0xf19004889c14889c6e8db6e57004889f048.H..H....nW.H..H
0xf2981c4e80000005b5f5e415c415d415e41......[_^A\A]A^A
0xf395f5dc36644896d5e4c8965504c897d48_].fD.m^L.ePL.}H
0xf494c89754048895d38b908000000ba0800L.u@H.]8........
0xf590000e835f7570090eb10b908000000ba...5.W..........
0xf6990000000e823f75700900f0b66662e0f.....#.W....ff..
0xf791f84000000 .....
0xec2f903e74900488b4350c600014c89f9e8b4..I.H.CP...L....
0xec30932f5ff904584f60f85544f0000660f6f2...E....TO..f.o
0xec31983800a0000f30f7f83e00a00004088bb.............@..
0xec329d00a00004c89abd80a0000488b4b4848....L......H.KHH
0xec3398b41104c8b4118488b4838488b50504c.A.L.A.H.H8H.PPL
0xec3498d8bd00a0000e8acab0f0090e90d4f00..............O.
0xec35900ba0700000031c9e83a282d004885c0......1..:(-.H..
0xec379c700636d642eba6000000031c9e81528..cmd..`...1...(
0xec3892d004885c00f84ca4400004989c7ba02-.H.....D..I....
0xec39900000031c9e8fd272d004885c00f840b...1...'-.H.....
0xec3a94d00004889437866c7002f44ba020000M..H.Cxf../D....
0xec3b90031c9e8df272d004885c00f842d4d00.1...'-.H....-M.
0xec3c90066c7002f53ba0200000031c94889c6.f../S.....1.H..
0xec3d9e8c2272d004885c00f84504d000066c7..'-.H....PM..f.
0xec3e9002f4341c6466a0049c7070200000048./CA.Fj.I......H
0xec3f98b4b7849894f0849c747100200000049.KxI.O.I.G.....I
0xec409c74718020000004989772049c7472802.G.....I.w I.G(.
0xec41900000049c74730020000004989473849...I.G0....I.G8I
0xec4398b436849894750488b83a80000004989.ChI.GPH......I.
0xec449475841b807000000b804000000ba0700GXA.............
0xec4590000b904000000488983c00200004c89.......H......L.
0xec469bbc802000048898bd00200006641c746.....H......fA.F
0xec4796b000041c64669 k..A.Fi
⋯3 more rows
0x58aff000000000000000000100000000000000................
0x58b0000d0a534d0d0a0d0a0000000000000000..SM............
0x58b010505249202a20485454502f322e300d0aPRI * HTTP/2.0..
0x58b020c2a9e2b5c1b377ac54585e8deeab5d78......w.TX^...]x
0x58b03016161616161616161616161616161616................
0x58b04053535353535353535353535353535353SSSSSSSSSSSSSSSS
0x58b0505166446992be63c7c277cc65233493a6QfDi..c..w.e#4..
0x58b0603b26dcc85f9e5dd33ecf196439cb8ca7;&.._.].>..d9...
0x58b070cd38cc8f551f0b2c19626e8a09954e10.8..U..,.bn...N.
0x58b080ffffffffffffff7fffffffffffffff7f................
0x58b0902d431cebe2361a3f0080e03779c34143-C...6.?...7y.AC
0x58b0a0ff3f3f3f000000000000000000000000.???............
0x58b0b0f0808080000000000000000000000000................
0x58b0c00f0e0d0c0b0a09080706050403020100................
⋯3 more rows
0x58b10098aa07d8015b8312be853124c37d0c55.....[....1$.}.U
0x58b110745dbe72feb1de80a706dc9b74f19bc1t].r........t...
0x58b120c1699be48647beefc69dc10fcca10c24.i...G.........$
0x58b1306f2ce92daa84744adca9b05cda88f976o,.-..tJ...\...v
0x58b14052513e986dc631a8c82703b0c77f59bfRQ>.m.1..'....Y.
0x58b150f30be0c64791a7d55163ca0667292914....G...Qc..g)).
0x58b160850ab72738211b2efc6d2c4d130d3853...'8!...m,M..8S
0x58b17054730a65bb0a6a762ec9c281852c7292Ts.e..jv.....,r.
0x58b180a1e8bfa24b661aa8708b4bc2a3516cc7....Kf..p.K..Ql.
0x58b19019e892d1240699d685350ef470a06a10....$....5..p.j.
0x58b1a016c1a419086c371e4c774827b5bcb034.....l7.LwH'...4
0x58b1b0b30c1c394aaad84e4fca9c5bf36f2e68...9J..NO..[.o.h
0x58b1c0ee828f746f63a5781478c8840802c78c...toc.x.x......
0x58b1d0faffbe90eb6c50a4f7a3f9bef27871c6.....lP......xq.
0x58b1e022002200220022002200220022002200".".".".".".".".
0x58b1f05c005c005c005c005c005c005c005c00\.\.\.\.\.\.\.\.
0x58b20000000000000000000700000000000000................
0x58b21001000000000001000000200000000000.......... .....
0x58b22007000000000000000000000000000000................
⋯4 more rows
0x58b2701c010000100100001801000014010000................
0x58b2800123456789abcdeffedcba9876543210.#Eg........vT2.
0x58b29062736f636b65742d70726f746f636f6cbsocket-protocol
0x58b2a07365632d776562736f636b65742d7072sec-websocket-pr
0x58b2b000000000010000000200000003000000................
⋯7 more rows
0x5922580b000000000000002b2c00000c000000........+,......
0x5922682f6170692f6167656e742f636f6e6e65/api/agent/conne
0x5922786374067773733a2f2fc0c00023636f6ect.wss://...#con
0x5922886e656374696f6e2e776562736f636b65nection.websocke
⋯15 more rows