Source: | Binary string: C:\Windows\dll\System.Management.Automation.pdb86)= source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: System.Management.Automation.pdbBB source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbFile source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: ws\System.Management.Automation.pdbpdbion.pdbProg source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: mscorrc.pdb source: powershell.exe, 00000004.00000002.2115382966.0000000002300000.00000002.00000001.sdmp |
Source: Scanned_25526662-Payment.xls | String found in binary or memory: http://lankarecipes.com/Sparc.jp |
Source: powershell.exe, 00000004.00000002.2117932442.00000000035FD000.00000004.00000001.sdmp | String found in binary or memory: http://lankarecipes.com/Sparc.jpPE |
Source: powershell.exe, 00000004.00000002.2115458651.00000000023E0000.00000002.00000001.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous. |
Source: powershell.exe, 00000004.00000002.2115458651.00000000023E0000.00000002.00000001.sdmp | String found in binary or memory: http://www.%s.comPA |
Source: powershell.exe, 00000004.00000003.2106075655.0000000000275000.00000004.00000001.sdmp | String found in binary or memory: http://www.piriform.com/ccleaner |
Source: powershell.exe, 00000004.00000003.2106075655.0000000000275000.00000004.00000001.sdmp | String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv |
Source: Scanned_25526662-Payment.xls, type: SAMPLE | Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score = |
Source: 00000004.00000002.2114806826.0000000001C46000.00000004.00000001.sdmp, type: MEMORY | Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score = |
Source: C:\Users\user\Desktop\75FE0000, type: DROPPED | Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score = |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ........................#.........h.......F...............F.......A.....`IC........v.....................KJ..................................... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....#..................j......................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v..../...............y..j......l...............1.............}..v....X.......0.\.............................0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v..../..................j......................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....;...............y..j......l...............1.............}..v............0.\.....................d.......0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....;..................j....x.................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0.1.............}..v............0.\.............X.l.....".......0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....G..................j......................1.............}..v....@.......0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....S...............y..j......l...............1.............}..v............0.\.....................|.......0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....S..................j....X.................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v...._...............y..j......l...............1.............}..v............0.\.............................0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v...._..................j....X.................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....k....... . . .d.E.x.c.e.p.t.i.o.n.........1.............}..v....x.......0.\.............X.l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....k..................j....0.................1.............}..v............0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....w...............y..j......l...............1.............}..v............0.\.....................l.......0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v....w..................j......................1.............}..v....(.......0.\...............l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v............ .......y..j......l...............1.............}..v............0.\.............X.l.............0............... |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Console Write: ................y=.v.......................j....p.................1.............}..v............0.\...............l.............0............... |
Source: | Binary string: C:\Windows\dll\System.Management.Automation.pdb86)= source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: System.Management.Automation.pdbBB source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbFile source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: ws\System.Management.Automation.pdbpdbion.pdbProg source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2115960184.0000000002B87000.00000004.00000040.sdmp |
Source: | Binary string: mscorrc.pdb source: powershell.exe, 00000004.00000002.2115382966.0000000002300000.00000002.00000001.sdmp |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\cmd.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\hh.exe VolumeInformation |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation |