Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details. Loading content, please wait Toggle navigation. External Reports VirusTotal. Risk Assessment. Network Behavior Contacts 1 domain. View all details. This report has 16 indicators that were mapped to 9 attack techniques and 6 tactics. Learn more Executes powershell requesting to bypass execution policy Uses powershell with a windows hidden commandline param Uses powershell with an encoded commandline Executes powershell with commandline T Command-Line Interface Execution Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms.
Learn more Modifies proxy settings Creates or modifies windows services T Process Injection Defense Evasion Privilege Escalation Process injection is a method of executing arbitrary code in the address space of a separate live process.
Learn more Reads Windows Trust Settings Reads information about supported languages Queries the display settings of system associated file extensions Reads the windows installation date Reads the active computer name Queries sensitive IE security settings Reads the cryptographic machine GUID. Download as CSV Close. Related Sandbox Artifacts. Associated SHAs 0eac0b5beeaedc6a7adffeafcfa2bed15d6b Informative 24 Anti-Reverse Engineering Creates guarded memory regions anti-debugging trick to avoid memory dumping details "wscript.
DLL" "powershell. All Details:. Filename Resources Icon. Visualization Input File PortEx. Tip: Click an analysed process below to view more details.
This report was generated with simulated network traffic. Domain Address Registrar Country erzurum. Contacted Hosts No relevant hosts were contacted. Download All Memory Strings B. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Learn more. Executes powershell requesting to bypass execution policy. Uses powershell with a windows hidden commandline param Uses powershell with an encoded commandline Executes powershell with commandline.
